340ec58b68
Inflate every receive-pack object under strict pack, size, and checksum bounds, resolve deltas against in-pack bases only, and scan the real decompressed payloads for runtime-token forms, private keys, SSH key material, and known provider token formats. Thin packs are rejected so no pushed content escapes the scan, and upstream Git exchanges now run under one absolute stream deadline. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
18 lines
692 B
YAML
18 lines
692 B
YAML
# services/hermes/scm-common/kustomization.yaml
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
configMapGenerator:
|
|
- name: hermes-scm-boundary
|
|
files:
|
|
- deadline_http.py=scripts/deadline_http.py
|
|
- git_pack_objects.py=scripts/git_pack_objects.py
|
|
- gitea_api.py=scripts/gitea_api.py
|
|
- gitea_api_policy.py=scripts/gitea_api_policy.py
|
|
- receive_pack_scan.py=scripts/receive_pack_scan.py
|
|
- scm_broker.py=scripts/scm_broker.py
|
|
- scm_broker_io.py=scripts/scm_broker_io.py
|
|
- scm_broker_server.py=scripts/scm_broker_server.py
|
|
- scm_broker_client.py=scripts/scm_broker_client.py
|
|
options:
|
|
disableNameSuffixHash: true
|