Skip to content

feat: open source take 2#3

Merged
lcarvalho-shielded merged 12 commits into
mainfrom
giles-open-source-node2
Jun 9, 2025
Merged

feat: open source take 2#3
lcarvalho-shielded merged 12 commits into
mainfrom
giles-open-source-node2

Conversation

@gilescope

@gilescope gilescope commented May 31, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Open sourcing of node

#3

@github-actions

github-actions Bot commented May 31, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Logo
Checkmarx One – Scan Summary & Details – f7caa843-1105-45ac-91c8-7739ed86c798

New Issues (69)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2021-3803 Npm-nth-check-1.0.2
detailsRecommended version: 2.0.1
Description: nth-check prior to 2.0.1 is vulnerable to Inefficient Regular Expression Complexity
Attack Vector: NETWORK
Attack Complexity: LOW

ID: kSOZHiCOsc%2Fy54ubO8TdSRcLdMKT2kl7E8GMw39ShQc%3D
Vulnerable Package
HIGH Cxdca8e59f-8bfe Npm-inflight-1.0.6
detailsDescription: In NPM `inflight` there is a Memory Leak because some resources are not freed correctly after being used. It appears to affect all versions, as the...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 7MjuL1KzmMG%2Fhqng4h5aj6CRRg%2FGAQsUf5sKRc2EKjs%3D
Vulnerable Package
MEDIUM CVE-2023-44270 Npm-postcss-7.0.39
detailsRecommended version: 8.4.31
Description: An issue was discovered in postcss versions prior to 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An at...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: n%2FpmVk560ZEe8v7GtDaUTXKKidhH9lWs%2BSR5%2B3HKwD4%3D
Vulnerable Package
MEDIUM CVE-2024-11831 Npm-serialize-javascript-4.0.0
detailsRecommended version: 6.0.2
Description: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain i...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: JVSbWLSrIulpxCgWBgfxGKWgoqP2UnPJc29bsTgy8cg%3D
Vulnerable Package
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 118
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: q1SQP%2Bw5FKruNDwGikShvIAld%2BE%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 70
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: vWy9BXGm2h11pzL0yk7%2FIG%2Flemw%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 54
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: EDMGpoe9HyhoSJ9IAopUXlTRnWw%3D
MEDIUM Container Capabilities Unrestricted /test-compose-latest.yml: 2
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: ChmchZrUAWATKVq%2FD3ILNqgci7k%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 86
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: tDg9MdRBoNyyxDfiUgAXJ4CbfoM%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 168
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: qbBKj8KzNDhNn2coPr8liZsunZ4%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 134
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: OFO9I4m5Ixkp7gjVJ2LpM49%2B5NU%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 102
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: VAkJSLR5VFPNnPQx%2Bh5z4BixzzY%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 150
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: 7qgfWZLjEq9LoTcWQp7uip5JP24%3D
MEDIUM Container Capabilities Unrestricted /test-compose.yml: 2
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: FBUCZiSa02Uzqnb8qsiMsBCAJ6Q%3D
MEDIUM Container Capabilities Unrestricted /fork-test-compose.yml: 35
detailsSome capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
ID: Q3HA07oRqNqOiD4Fc%2FLYGvxUoZU%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 141
detailsIncoming container traffic should be bound to a specific host interface
ID: 35hrkRKm%2F%2FHyhAcR%2BM0rosIXbXQ%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 77
detailsIncoming container traffic should be bound to a specific host interface
ID: rijY4GbNkm2p8MLO10z5%2BCu1e1g%3D
MEDIUM Container Traffic Not Bound To Host Interface /test-compose-latest.yml: 4
detailsIncoming container traffic should be bound to a specific host interface
ID: zYxSJHbPoO4pYi%2FD3BIZ3tmrmQ4%3D
MEDIUM Container Traffic Not Bound To Host Interface /test-compose.yml: 4
detailsIncoming container traffic should be bound to a specific host interface
ID: 75PCcqN7tdB38Fbqilp4z3frvBg%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 157
detailsIncoming container traffic should be bound to a specific host interface
ID: HOG%2B3p0VxXSf9NqbBJLJ0LbxSMo%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 109
detailsIncoming container traffic should be bound to a specific host interface
ID: AWPCswZ8oeJi0NqMN1PcqRFvnp8%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 56
detailsIncoming container traffic should be bound to a specific host interface
ID: BcpXnOQz9Fnb5Ffx9tpgIQrg35M%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 125
detailsIncoming container traffic should be bound to a specific host interface
ID: 3%2FO0%2B0W6OMBgzQmgEgWFOi5vCpo%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 93
detailsIncoming container traffic should be bound to a specific host interface
ID: 59iGAEnoXD2gxQDn%2BUmD%2BGwSNVU%3D
MEDIUM Container Traffic Not Bound To Host Interface /fork-test-compose.yml: 40
detailsIncoming container traffic should be bound to a specific host interface
ID: nkbOzb1ToZTTDiYMOsFHpkwkgpo%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 70
detailsCheck containers periodically to see if they are running properly.
ID: f3nKgedKNLICkMtp3gqtcjl0MG0%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 54
detailsCheck containers periodically to see if they are running properly.
ID: II2H5%2Fjif4jLMBQWFO9YU9wyUDM%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 118
detailsCheck containers periodically to see if they are running properly.
ID: pDUpW7iW9Vymf4fKnSDuB545twI%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 102
detailsCheck containers periodically to see if they are running properly.
ID: g7NQ2yapI9Vdn7tVWNmIn7GB2yE%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 150
detailsCheck containers periodically to see if they are running properly.
ID: OwxW2Mk0HzoD0218fBPeNrS6U6Q%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 86
detailsCheck containers periodically to see if they are running properly.
ID: Kr3BpyzZfVSqeFcPN%2FNp000Csb4%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 134
detailsCheck containers periodically to see if they are running properly.
ID: eEEkOL%2BNEDbIUpiyfrGw5I5%2BBBc%3D
MEDIUM Healthcheck Not Set /fork-test-compose.yml: 168
detailsCheck containers periodically to see if they are running properly.
ID: EVxAZFgQJgHvp8FkuDFLriyMKEg%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 35
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: GQWxl7yL6Dt4Ngn3ZGWM8QYMSWE%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 150
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: 1N9B5OsWgvveN2GuyL5O848d1N0%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 134
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: pjXXo7Yp2cE5Wtky%2BXzF%2Bi3B77o%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 86
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: 53%2B9lOwAlbCtTqxasUY3LZnncEI%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 70
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: 7v65i7ts4b6traMROeudtSOAXOU%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 168
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: cejIOhoPMwZQK16%2FAayTsbtV7pw%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 102
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: WiW9qfBrY6AhWwFZwjW6brJh3Ts%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 54
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: HU8tz5pJ%2Fx2xwOJVNN%2BqJ8Sdy68%3D
MEDIUM Memory Not Limited /fork-test-compose.yml: 118
detailsMemory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
ID: %2B16OwHVNPe5w7lUqUJxy2y8RrIc%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 118
detailsAttribute 'security_opt' should be defined.
ID: 5jw1HMKDCpD7EMjIdEAIICslbfw%3D
MEDIUM Security Opt Not Set /test-compose-latest.yml: 2
detailsAttribute 'security_opt' should be defined.
ID: NfhnF%2FsxIvLoJ4H0dWGus7aaeyg%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 102
detailsAttribute 'security_opt' should be defined.
ID: 939LnL5yK%2F3qfT34ZAeCrev0XFc%3D
MEDIUM Security Opt Not Set /test-compose.yml: 2
detailsAttribute 'security_opt' should be defined.
ID: qyNeUebY0pe1%2BJfF%2FIrcYWe%2BaRM%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 54
detailsAttribute 'security_opt' should be defined.
ID: kAzDyEj9Jm9Cz%2BLPuu7O4qMK2kc%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 168
detailsAttribute 'security_opt' should be defined.
ID: RUreJwngXzxVW4ATKaEDNKcFxRs%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 86
detailsAttribute 'security_opt' should be defined.
ID: bdd8BnHIclk1w%2Be3DHZsi8rwaco%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 134
detailsAttribute 'security_opt' should be defined.
ID: 7lhmYmmX7dXEBGPGQjNp3XFIj3s%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 150
detailsAttribute 'security_opt' should be defined.
ID: O7DV3N6CcFtVYkp46BRnGVMX7xE%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 70
detailsAttribute 'security_opt' should be defined.
ID: hDRmSq0NDQzIUQLZd05PspbfejI%3D
MEDIUM Security Opt Not Set /fork-test-compose.yml: 35
detailsAttribute 'security_opt' should be defined.
ID: fJ6vdVOtRsywG9XmUFoE7M7EjQA%3D
LOW Cpus Not Limited /fork-test-compose.yml: 35
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: %2BBFcVGxFnZr1YwkSHkIENPPoZ%2BE%3D
LOW Cpus Not Limited /fork-test-compose.yml: 150
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: uQh68aWtPElUmgBwJ8nmH15DpFg%3D
LOW Cpus Not Limited /fork-test-compose.yml: 86
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: awq%2F%2BNz8cP3Wa0VMQQIFUmjRVwU%3D
LOW Cpus Not Limited /fork-test-compose.yml: 134
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: 8koSpysPxhYQlfGYJQryeKJYJ1A%3D
LOW Cpus Not Limited /fork-test-compose.yml: 70
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: w6ToqSj4Hb5Ty%2FMxnkaU9IJBluw%3D
LOW Cpus Not Limited /fork-test-compose.yml: 168
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: JBK8KK%2B0FiYygYWWITnkBOFXBzU%3D
LOW Cpus Not Limited /fork-test-compose.yml: 118
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: t2XfjN%2B8Mwhv9M27lTqe1NVV9dA%3D
LOW Cpus Not Limited /fork-test-compose.yml: 102
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: %2B68V2HAdIKRKskaj57ncFVjGius%3D
LOW Cpus Not Limited /fork-test-compose.yml: 54
detailsCPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
ID: zsbIu8f%2BrWwNHTzHHTx%2F2cXwr1o%3D
LOW Cx8bc4df28-fcf5 Npm-debug-2.6.9
detailsRecommended version: 4.4.0
Description: In NPM "debug" versions prior to 4.4.0, the "enable" function accepts a regular expression from user input without escaping it. Arbitrary regular e...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: 81IecNRDglonIPtnjgDTBhy9%2BlBX9lcd4C48QrDDoP4%3D
Vulnerable Package
LOW Cx8bc4df28-fcf5 Npm-debug-3.2.7
detailsRecommended version: 4.4.0
Description: In NPM "debug" versions prior to 4.4.0, the "enable" function accepts a regular expression from user input without escaping it. Arbitrary regular e...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: qQpf%2B0hhtC2bKtPHkmGbteg1Z8GbAr7xb%2F8lmRT3IKM%3D
Vulnerable Package
LOW Cxda14f253-4e52 Npm-bluebird-3.7.2
detailsDescription: The package `bluebird` is vulnerable to memory leak, when running the function longStackTraces() with the flag `--expose_gc`. This causes a signifi...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: Up5Vg0dB%2BllgihKXwUtSHzfbYa7TyJ%2BadsZAIBNpD3U%3D
Vulnerable Package
LOW Unpinned Actions Full Length Commit SHA /changes_check.yml: 58
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
ID: 5IBZs5Xe5nPKHH0OTU7T2qaIkAY%3D
LOW Unpinned Actions Full Length Commit SHA /nightly-build-check.yml: 27
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
ID: DmYQBjwBAgWFnVHKmB%2F80Hsyl%2FM%3D
LOW Unpinned Actions Full Length Commit SHA /nightly-build-check.yml: 22
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
ID: CMFrIj%2F4Zqd11Ce26noT2%2BTEEzg%3D
LOW Unpinned Actions Full Length Commit SHA /local-environment-tests.yml: 41
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
ID: fijCa6j5C6V4%2BMmSz174rZyXnWw%3D

@gilescope gilescope marked this pull request as ready for review May 31, 2025 11:20
@gilescope gilescope requested review from a team as code owners May 31, 2025 11:20
@lcarvalho-shielded lcarvalho-shielded merged commit 77aaca9 into main Jun 9, 2025
14 checks passed
@lcarvalho-shielded lcarvalho-shielded deleted the giles-open-source-node2 branch June 9, 2025 09:31
m2ux added a commit that referenced this pull request Jan 15, 2026
@m2ux
fix(local-env): calculate mapping_validator_address dynamically
0e2ae76 
The cNIGHT genesis patching was only updating cnight_policy_id but not
the mapping_validator_address. When contracts are recompiled with local
one-shot UTxOs, the script hashes change, causing a mismatch between:
- The address the node observes (from static genesis config)
- The address where tests create UTxOs (from compiled CBOR)

This fix:
- Installs python3-pip and bech32 library in midnight-setup container
- Calculates mapping_validator_address from the compiled script hash
- Patches both cnight_policy_id AND mapping_validator_address

Per lessons learned #3: "Contract Hashes Change Per Deployment"
This was referenced Feb 26, 2026
Merged
Merged
@chrispalaskas chrispalaskas mentioned this pull request Apr 13, 2026
Merged
14 tasks
This was referenced Jun 9, 2026
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@justinfrevert justinfrevert justinfrevert approved these changes

+2 more reviewers

@andreyjv andreyjv andreyjv approved these changes

@MB-IOHK MB-IOHK MB-IOHK approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

skip-changes-check-all

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@gilescope @andreyjv @justinfrevert @MB-IOHK @lcarvalho-shielded