HHostingByteSoftware
Ctrl K
ComunidadGuías…

SECURITY_AUDIT_REPORT.md

Rama main · réplica de lectura del repositorio original.

Archivo original ↗Preguntar a KiBot
Security Audit Report — Aegis Latent Core
=========================================

> **Historical archive.** This automated report is retained for the historical
> run it describes. Its findings and remediation notes are not a statement of
> current v4 status and are superseded for current navigation by the
> [v4 evidence index](evidence/INDEX.md),
> which records newer gates, bounded evidence, and unresolved external blockers.

Summary (automated findings)
-----------------------------

- Repository scanned for common sensitive patterns (API keys, secrets): none found.
- **No `FIXME`, `TODO` or `HACK` marker remains in shipped code.** Measured 2026-09-21 across `aegis/`, `aegis_server/`, `aegis_rust_v2/src/`, `sdk/`, `dashboard/`, `config/` and `deploy/`: every occurrence of those words in the tree is a detector pattern, a comment about the detector rule, or a test fixture. `tests/test_no_defect_markers_in_shipped_code.py` keeps it that way.
- Dangerous patterns found in multiple files: `exec(`, `eval(`, `pickle.load` — these require manual review when handling untrusted inputs.
- Rust extension build failed in CI environment: linker errors referencing Python C API symbols (PyObject_Str, _Py_IncRef, PyErr_Print, etc.). Likely root causes:
  - Missing libpython development headers / shared library (install `libpythonX.Y-dev` / `pythonX.Y-dev`), or
  - PyO3 version mismatch with the local Python runtime (Python 3.14 vs PyO3 max supported 3.13), or
  - Building with `cargo test` attempts a different linking mode than `maturin develop`.
- Local developer environment lacked static tools (ruff, mypy, bandit, pip-audit, pytest) — CI should run these in a controlled matrix.
- GPG signing of commits failed in the runner due to pinentry timeout. Local key agents must be configured for non-interactive signing in CI, or disable commit signing in automation.

Immediate remediation (practical)
---------------------------------

1. Rust build errors
   - Install Python development headers for the Python ABI you plan to use (e.g. `sudo apt install python3.11-dev` or the equivalent for your distro).
   - Prefer building the PyO3 extension with maturin in a matching virtualenv, or run the CI workflow which uses setup-python + maturin.
   - Short-term workaround: set `PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1` before building (documented in docs/RUST_BUILD.md). This allows building against ABI3 and mitigates PyO3 version checks when appropriate.

2. Unsafe serialisation / dynamic execution
   - Audit all occurrences of `pickle.load`, `exec`, `eval` and `os.system` for usage with untrusted data.
   - Replace `pickle` with `json` or `msgpack` for on-disk interchange when possible.
   - If `pickle` is required, restrict inputs to signed, authenticated artifact bundles and validate integrity prior to un-pickling.

3. Developer tooling and CI
   - Add a GitHub Actions workflow `forensic.yml` to run `ruff`, `mypy`, `bandit`, `pip-audit`, `pytest` (matrix across Python 3.11–3.13) and a Rust build step using `maturin`.
   - Ensure the workflow sets `PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1` or uses a supported Python version.

4. Secrets and signing
   - Do not store signing keys or private keys in the repo. Ensure `AEGIS_SIGNING_KEY` is injected in production environment variables or a secrets manager.
   - For non-interactive commits in automation, either configure git to not GPG-sign commits, or provide a signing agent with unlocked keys accessible to the runner.

Files added by this run
-----------------------

- tools/visualizer/* — a lightweight dashboard that summarises Python/Rust symbols and shows a flowchart of the main components.
- tools/forensic/forensic_checks.py — automated forensic checks capturing pattern hits, syntax errors, and a Rust-build attempt (report written to tools/forensic/report.json).
- aegis/core/rust_integration.py — runtime helper wrappers to safely attempt use of aegis_rust where available (non-fatal if missing).

How to reproduce locally (developer)
------------------------------------

# 1. Run the forensic checks
python tools/forensic/forensic_checks.py
# Review tools/forensic/report.json

# 2. Try building the Rust extension (recommended inside a matching venv)
export PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
cd aegis_rust_v2
maturin develop --release

# 3. Run quick visualizer
pip install -r tools/visualizer/requirements.txt
uvicorn tools.visualizer.app:app --reload --port 8081
Open http://localhost:8081/

Notes for sensitive audiences
-----------------------------

- For governments / military / medical deployments, consider an HSM or KMS for `AEGIS_SIGNING_KEY` and strictly controlled key rotation and auditing.
- For forensic use and any later admissibility question — a judicial determination, not a property of this software — record full chain of custody (timestamps, hashes, signer identity) and store signed SBOMs with release artifacts.

Actions taken in this run
-------------------------

- Added tools/forensic/triage_unsafe.py to enumerate risky API usage and generate remediation guidance (tools/forensic/unsafe_remediation.md when run).
- Added aegis/core/safe_serialization.py offering safe JSON helpers and a guarded pickle loader that enforces allowed primitive types.
- Added scripts/build_rust.sh to streamline maturin-based builds in an isolated venv and fail early when compilers/toolchain are missing.
- Enhanced tools/visualizer with documentation and snapshots (tools/visualizer/test_results.json, tools/visualizer/summary.json) to make the dashboard ready-to-run.
- Implemented lazy-loading for aegis.core to allow lightweight tooling and unit tests to run without heavy optional dependencies.

Recommended immediate next steps:
- Run the CI workflow (.github/workflows/forensic.yml) on GitHub to collect full build artifacts and address any remaining Rust linking errors.
- Marker-based remediation is retired: there are no `TODO`/`FIXME` markers left in shipped code to target, and `TODO_ISSUES.md` is not in this tree. Pending security and chain-of-custody work is tracked as rows in `docs/ROADMAP.md` (`AUD-*`) and `docs/REGISTRY.md` (`REG-*`), each carrying its own evidence and terminal state.
- Consider pinning or upgrading PyO3 only after CI confirms the target Python matrix and toolchain availability.