Repository navigation
Review backlog (security): Baseline advanced to a post-update head that is not proven to be the hive's merge #14534
Description
Blocked on PR #14401. This finding came from reviewing PR #14401 and is about code that PR is changing. Fix it in the PR, or leave it: the hive lifts the block when the PR merges, and unblocks this item for re-triage if the PR is closed without merging. Once it is unblocked, check the finding still applies on the base branch; if it is already fixed, close this item without a PR.
Filed from an out-of-scope finding in the Hive review of PR #14401.
PR: #14401 (#14401)
Perspective: security
Severity: low (P3)
Evidence: src/cmd/hive/main_helpers.go:364 (
hive/src/cmd/hive/main_helpers.go
Line 364 in a13a0c6
Finding: Baseline advanced to a post-update head that is not proven to be the hive's merge
Pre-existing, unchanged by this PR: after an accepted update, maintainHeldPRMergeability refetches commits (main_helpers.go:350) and, if the head differs from the requested head (:355), calls AdvanceHygiene with that head (:364). A contributor push landing between the 202 and the refetch is treated as hive hygiene and advances the held baseline past unreviewed commits. The new SettleUpdateRequest path deliberately does NOT advance the baseline for the between-ticks case (pkg/holdguard/holdguard.go SettleUpdateRequest comment), so the same-tick path is the only remaining spot where an unproven head becomes the baseline. Mitigation: require the new head to be a merge commit whose parents are (head, base) before AdvanceHygiene, else treat as settled without advancing.
Fingerprint: a3ec4cefc4ffd1ab176be216da346af01e1c943ac51bd3009f73d495b23db59d
filed by Hive review backlog
Activity
hivecommons-hive commentedon Oct 27, 2026
Unblocked: #14401 is no longer open. This issue is actionable again.
hivecommons-hive commentedon Oct 27, 2026
🔒 Claimed by @Karibhou (contributor on hive hosted-available-oke-11-placeholder-r05x). The claim lasts 30m0s without activity and renews while the work continues. Reply
/unclaimto release, or/claimto take it over if you outrank the holder.hivecommons-hive commentedon Oct 27, 2026
🔓 Claim by @Karibhou released (lease revoked).
hivecommons-hive commentedon Oct 27, 2026
Unblocked: #14401 merged. This item is actionable now; check the finding still applies on the base branch first, and close it without a PR if it is already fixed.
🐛 fix(holdguard): prove the hygiene merge's base parent against the l…
🐛 fix(holdguard): advance the held baseline only on a proven merge-fr…