Does the built artifact still carry the vendor's words? Pure: the strings the sources declare secret go in, the strings the artifact carries go in, and the ones present in both come out.
An AOT jar is audited today for what it LINKS against (promote/classes).
Nothing audited what it SAYS. :elide-meta removes def metadata and the
staging pass removes the ns docstring, but neither is observed after the
fact, so an elision that silently stops running publishes a readable jar and
reports success.
The check is set intersection rather than a heuristic on purpose. A detector
that scored strings for prose would have to guess whether
"Resolve user-facing cartography intent into stable indexed-world data." is
a leaked docstring or a :summary the program prints, and it is the second
one. Only the source knows which strings were meant to be private, so the
source is what supplies them.
Does the built artifact still carry the vendor's words? Pure: the strings the sources declare secret go in, the strings the artifact carries go in, and the ones present in both come out. An AOT jar is audited today for what it LINKS against (`promote/classes`). Nothing audited what it SAYS. `:elide-meta` removes `def` metadata and the staging pass removes the ns docstring, but neither is observed after the fact, so an elision that silently stops running publishes a readable jar and reports success. The check is set intersection rather than a heuristic on purpose. A detector that scored strings for prose would have to guess whether "Resolve user-facing cartography intent into stable indexed-world data." is a leaked docstring or a `:summary` the program prints, and it is the second one. Only the source knows which strings were meant to be private, so the source is what supplies them.
(audit {:keys [secrets constants-by-entry entries allowed-source unreadable]})The opacity verdict for one artifact.
:secrets strings the sources declared private :constants-by-entry entry name -> strings that entry carries :entries every entry name in the artifact :allowed-source entry prefixes whose sources ship on purpose :unreadable entries whose bytes could not be parsed
:opacity/leaking states that a listed string is present in both the source
and the artifact. It does NOT state that the artifact is safe when clean:
this reads the text an artifact carries, and says nothing about the call
graph, the numeric constants, or the names of anything. :opacity/unread
is carried for the same reason: a verdict has to say what it did not look
at.
The opacity verdict for one artifact. :secrets strings the sources declared private :constants-by-entry entry name -> strings that entry carries :entries every entry name in the artifact :allowed-source entry prefixes whose sources ship on purpose :unreadable entries whose bytes could not be parsed `:opacity/leaking` states that a listed string is present in both the source and the artifact. It does NOT state that the artifact is safe when clean: this reads the text an artifact carries, and says nothing about the call graph, the numeric constants, or the names of anything. `:opacity/unread` is carried for the same reason: a verdict has to say what it did not look at.
(leaked secrets constants-by-entry)One finding per secret an artifact entry still carries.
constants-by-entry maps an artifact entry name to the set of strings that
entry holds, which for a class file is its constant pool. A secret is
reported once per entry that carries it, because that is where the operator
has to go to remove it.
One finding per `secret` an artifact entry still carries. `constants-by-entry` maps an artifact entry name to the set of strings that entry holds, which for a class file is its constant pool. A secret is reported once per entry that carries it, because that is where the operator has to go to remove it.
(preview text)text shortened to a single line no longer than preview-length.
`text` shortened to a single line no longer than `preview-length`.
(report {:opacity/keys [findings verdict secrets-audited unread]})A build-facing description of a leaking audit, or nil when it is clean.
A build-facing description of a leaking `audit`, or nil when it is clean.
(source-entries entries {:keys [allowed] :or {allowed []}})One finding per Clojure source file entries carries.
allowed are entry-name prefixes whose sources are published on purpose:
clj-kondo hook exports are the fleet's case, since a linter cannot read a
compiled hook.
One finding per Clojure source file `entries` carries. `allowed` are entry-name prefixes whose sources are published on purpose: clj-kondo hook exports are the fleet's case, since a linter cannot read a compiled hook.
(source-findings {:opacity/keys [findings]})The findings of audit that name a readable Clojure source the artifact
ships. A subset of :opacity/findings, never a re-audit.
The findings of `audit` that name a readable Clojure source the artifact ships. A subset of `:opacity/findings`, never a re-audit.
(source-report audit)A build-facing description of the sources a private artifact ships, or nil when it ships none.
Separate from report because the two findings are not the same claim. A
docstring that survived elision is prose the artifact should not repeat; a
source file is the artifact not being compiled at all, and no amount of
elision addresses it.
A build-facing description of the sources a private artifact ships, or nil when it ships none. Separate from `report` because the two findings are not the same claim. A docstring that survived elision is prose the artifact should not repeat; a source file is the artifact not being compiled at all, and no amount of elision addresses it.
(source-secrets source)The strings in source that AOT must not carry into the artifact.
Two classes, both proof against :elide-meta, which reaches def metadata
only:
ns docstring part of the constant map the ns macro emits
defprotocol docstring part of the :sigs map, the protocol var's VALUE
Docstrings shorter than min-secret-length are not audited.
The strings in `source` that AOT must not carry into the artifact. Two classes, both proof against `:elide-meta`, which reaches `def` metadata only: ns docstring part of the constant map the `ns` macro emits defprotocol docstring part of the `:sigs` map, the protocol var's VALUE Docstrings shorter than `min-secret-length` are not audited.
Entry suffixes that make an artifact readable outright.
Entry suffixes that make an artifact readable outright.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |