Prepare the 1.4.0 release and stop the help text overclaiming - #4
Merged
Conversation
Cut the changelog's Unreleased section to 1.4.0 and record the limitations a user will meet in this build but that this release does not fix, so the release notes do not read wider than the change. The largest is a file filter that tests the absolute path of the scan target, so a checkout under a directory named docs scans zero files and exits 0. It is present in 1.3.0 as well, and the changelog now says how to notice it. No behaviour changes. Finding sets are identical to the pre-branch binary on five real trees carrying 110, 995, 494, 633 and 461 findings. The rest is hygiene the release surfaced: - gofmt on pkg/patterns/matcher.go, which the previous change left unformatted. CI does not catch this: there is no .golangci.yml, so golangci-lint runs its defaults and gofmt is not among them. - The copyright notice said 2025 on 35 Go files, LICENSE and the Makefile, while the repository has been edited through 2026. Now 2025-2026, matching the sibling repositories. - .gitignore no longer lists editor assistant files. They are in .git/info/exclude, so nothing becomes committable, and a public repository should not carry the list.
- Remove 38 em-dashes. Label lists take a colon, prose takes a comma or a sentence break. No other file in the repository contained one. - The toolkit section still linked the pre-rename csnp/qramm-cryptodeps and csnp/qramm-tls-analyzer, which resolve only through GitHub's redirect. The table at the top of the same file already used the canonical names. - The subtitle said "Find every cryptographic algorithm in your codebase". The scanner has known coverage gaps and a path filter that can silence a whole scan, both recorded in the changelog, so "every" is not a claim this build meets. It now says "Inventory the cryptography in your codebase". Also, the version command's copyright line said 2025 while the file headers now say 2025-2026. Verified: remote Git URL scanning, the README's headline capability, reports 192 findings across 71 files on github.com/golang-jwt/jwt. Finding sets remain identical to the pre-branch binary on four real trees.
The fresh-user release test found four capability claims that are not true of this build. Every one was reproduced by hand against the release binary and against the released 1.3.0 binary, and all four are present in 1.3.0 as well, so none is new. What is new is that this release claims to be the one where outputs tell the truth, so shipping them undisclosed is not an option. - scan --help listed DSA under "Asymmetric algorithms". DSA.generate(2048) matches no pattern under any combination of flags, including --include-quantum-safe, --verbose and --include-imports. DSA is quantum vulnerable, so this is a false negative on the tool's core purpose. The list no longer claims it, and the help says plainly that it is not detected, along with the whole-word matching that also misses RSAPrivateKey and AESCipher. - The list also implied AES and SHA-256/384/512 were undetected, because a default scan reports none of them. They are detected and withheld as quantum-safe. The help now says that and names the flag. - --context, --max-depth and --git-history are accepted and ignored. Measured: --context 0 and --context 8 both render three source lines either side; --max-depth 1 scans the same six files as unlimited; --git-history finds nothing in a repository whose MD5 and RC4 exist only in an earlier commit. --group-by is the same for severity, category and quantum, which produce output byte-identical to an invalid value. --group-by file works. The changelog's determinism claim was also wider than the fix. The findings are in a stable order in every format, but the text report's "Categories Found" block is rendered from a map and differs on every run: six runs of the identical command produced six different hashes, on 1.3.0 and on this build. Anyone diffing a saved text report was being promised something untrue. The claim is now scoped and the limitation is recorded. The known-limitations section also gained the silent skip of unreadable files, the silently ignored malformed .cryptoscan.yaml, and the streaming total that disagrees with the final total. No behaviour changes. Finding sets identical to the pre-branch binary on five real trees carrying 110, 995, 494, 633 and 461 findings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts the changelog for 1.4.0 and corrects the capability claims the release test
found. No behaviour changes: finding sets are byte-identical to the pre-branch
binary on five real trees carrying 110, 995, 494, 633 and 461 findings.
The release test found four claims this build does not meet
Every one was reproduced by hand against both the 1.4.0 candidate and the
released 1.3.0 binary, and every one is present in 1.3.0, so none is new. They
are disclosed rather than fixed, because fixing them means changing detection
and this branch exists to ship the binary that was tested.
scan --helplisted DSA under "Asymmetric algorithms".DSA.generate(2048)matches no pattern under any combination of flags. DSA is quantum vulnerable,
so this is a false negative on the tool's core purpose.
default scan reports none of them. They are detected and withheld as
quantum-safe, which the help now says, naming the flag that shows them.
--context,--max-depth,--git-historyand--group-byfor severity,category and quantum are accepted and ignored. Measured:
--context 0and--context 8both render three source lines either side; depths 0, 1, 2, 3and -1 scan the same six files; a repository whose MD5 and RC4 exist only in
HEAD~1reports neither with or without--git-history; and the three--group-byvalues produce output byte-identical to an invalid value.stable order in every format, but the text report's "Categories Found" block
is rendered from a map: six runs of the identical command produced six
different hashes, on 1.3.0 and on this build.
A
docsdirectory anywhere in the absolute path of the scan target alsosuppresses the whole scan at exit 0, and an unreadable file is skipped in
silence. Both are in the known-limitations section with the counts a user can
check.
Also in this branch
pkg/patterns/matcher.go, which the previous change leftunformatted. There is no
.golangci.yml, so gofmt is not among the defaultlinters and CI did not catch it.
2025-2026across 35 Go files, LICENSE, the Makefile and theversion command, matching the sibling repositories.
.gitignoreno longer lists editor assistant files; they are in.git/info/exclude.had any, plus two pre-rename repository links and a subtitle that promised
to find "every cryptographic algorithm".
Verification
official SARIF 2.1.0, both fetched upstream.
version, JSONtool.version, SARIFdriver.versionanddriver.semanticVersion, and CBOMmetadata.tools[0].versionare the same string.injects the version.
github.com/golang-jwt/jwt.