Release 1.3.1: offline Kerberos evidence audit - #54
netanelcyber wants to merge 1 commit into
Conversation
Add 14 evidence checks, conservative verdicts, lazy CLI routing, documentation, and 35 regression tests. Preserve the published 1.3.0 package sources and resources. Verify built distributions before publishing.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d6ec1be008
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| - name: Publish to PyPI | ||
| if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.pypi_environment == 'pypi') | ||
| if: github.event_name == 'push' || github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.pypi_environment == 'pypi') |
There was a problem hiding this comment.
A push to release/kerberos-evidence-1.3.1 already runs this production upload with version 1.3.1, but publishing the corresponding GitHub release—or pushing another commit to that branch—runs the same upload again. Because PyPI distribution filenames cannot be replaced and skip-existing is not enabled, the later workflow fails with the repository guide's documented “Filename already exists” error. Use a single publication trigger or explicitly make duplicate uploads idempotent.
Useful? React with 👍 / 👎.
| checks = [ | ||
| _check( | ||
| "KERB-SCAN-RESULT-INTEGRITY", | ||
| "FAIL" if contradictions else "PASS", |
There was a problem hiding this comment.
When execution.results is empty—which the accepted schema permits—this unconditional fallback marks scan integrity as PASS, and the negative-evidence check immediately below also becomes PASS. The resulting summary therefore reports two evaluated, passing checks despite having no tool-result evidence, contradicting the audit's stated rule that missing evidence is not a pass and making an incomplete report appear partially validated. Return NOT_EVALUATED for these checks when rows is empty.
Useful? React with 👍 / 👎.
| @@ -1 +1,8 @@ | |||
| __version__ = "1.3.0" | |||
| __version__ = "1.3.1" | |||
There was a problem hiding this comment.
This release updates the package's public version to 1.3.1, but adpentest/core.py still exports __version__ = "1.3.0". Consumers that historically import the scanner module and inspect adpentest.core.__version__ therefore receive a version that disagrees with both adpentest.__version__ and the installed distribution metadata. Update the remaining constant or derive it from the package-level version so all public version checks agree.
Useful? React with 👍 / 👎.
1 participant
Scan logs can report successful execution despite application errors, and unreachable Kerberos services cannot support a non-vulnerable verdict. This release adds an offline review route that makes those limits explicit.
Changes:
adpentest kerberos-auditfor supplied scan logs/JSON, directory exports, and Windows Security event XML/JSON.release/kerberos-evidence-1.3.1branch, using the existing PyPI secret names or configured Trusted Publisher.Validation:
twine check; installed legacy CLI help works.054311b:TestExecuteAdTool.test_execute_ad_tool_timeoutandTestLuaNmapChecker.test_run_cve_check_timeout.The generated scanning core is unchanged. User-supplied logs are not included.
Publication completed:
acf542926b4a6e51141b430639f1d037b06d49760cd9235aa083a2c2c5fbfb09; all 18 packaged source/resource files match commitd6ec1be008462731b63a4f5b6d54c2dc4b773768.