fix: scan model links in oci layers

[mldangelo-oai]

Summary

• scan safe OCI symlink and hardlink members with model-looking names using container-root path semantics
• resolve link chains only through metadata-valid members admitted by active preflight and entry budgets
• resolve same-layer paths through admitted intermediate directory symlinks while preserving root containment and cycle bounds
• apply per-file, per-layer, and whole-manifest extraction limits to the resolved payload before copying
• keep duplicate target paths ambiguous and key resolution caching by the actual TAR header so duplicate link names cannot reuse the wrong target
• deduplicate equivalent aliases and path-compress direct link-chain resolution
• bound aggregate component-link traversal work linearly and memoize only complete resolved paths

False-positive / false-negative audit

• enforce max_file_size against target payloads rather than zero-size link headers
• prevent resolution beyond preflight_member_limit / max_oci_layer_entries
• translate POSIX-absolute OCI symlinks to archive-root members
• scan each distinct duplicate link header's own target instead of colliding in a normalized-name cache
• accept valid same-layer paths such as models -> payloads plus weights.onnx -> models/data.bin
• preserve cumulative extraction budgets for regular members and aliases
• fail closed with an operationally explicit check when aggregate link resolution exceeds its linear budget
• cache exact paths only, so a cyclic or rewritten child suffix cannot poison a benign sibling
• cover relative, absolute, forward, oversized, cyclic, duplicate, repeated-alias, aggregate-budget, component-symlink, long-chain, cache-poisoning, and resolution-exhaustion cases

Validation

• complete associated OCI scanner module: 149 passed
• adversarial scaling probe: 200 component links plus 200 distinct aliases stopped at the 1,600-step linear cap
• scoped Ruff check and format check
• scoped mypy for the scanner and its tests
• git diff --check origin/main...HEAD
• exact published tree: 69079ef35c8a66d8fa38af71bfd447db1bb24466

Known limitation

Cross-layer symlink targets require an overlay-aware index with OCI whiteout semantics. Until that broader support exists, unresolved cross-layer links fail closed as incomplete coverage.

All inline review threads are resolved. Full pytest remains delegated to CI. Final reviewed head: 5eb923c3ac440dd35b8e6a3673aefe76317298c9, based on main c55de216637b0ca341cd6659d915d1cc2c4f5e2c.

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 12 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 12 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 1.353s -> 1.351s (-0.2%).

Workload	Benchmark	Target	Size	Files	Baseline	Current	Change	Status
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_hex]	nested_hex	130 B	1	526.9us	545.9us	+3.6%	stable
chunked-upload-stream	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_upload_stream	chunked_stream	278.2 KiB	1	110.26ms	108.62ms	-1.5%	stable
padded-multi-stream-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_padded_multi_stream_upload	multi_stream_padded	4.1 KiB	1	589.8us	598.3us	+1.5%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_base64]	nested_base64	98 B	1	522.0us	528.9us	+1.3%	stable
clean-training-checkpoint	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_clean_training_checkpoint	safe_large	278.2 KiB	1	107.40ms	106.20ms	-1.1%	stable
single-checkpoint-preflight	tests/benchmarks/test_scan_benchmarks.py::test_scan_single_checkpoint_before_load	single_checkpoint.pkl	183.0 KiB	1	67.86ms	67.20ms	-1.0%	stable
suspicious-pickle-intake	tests/benchmarks/test_scan_benchmarks.py::test_scan_suspicious_pickle_intake	suspicious-intake	183.8 KiB	4	120.37ms	119.65ms	-0.6%	stable
warm-cache-rescan	tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan	release-candidate	547.3 KiB	32	105.36ms	105.97ms	+0.6%	stable
direct-malicious-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_direct_malicious_upload	malicious_reduce	52 B	1	492.3us	490.9us	-0.3%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_raw]	nested_raw	78 B	1	521.5us	522.6us	+0.2%	stable
duplicate-heavy-registry	tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_registry_snapshot	registry-snapshot	915.2 KiB	13	370.63ms	371.29ms	+0.2%	stable
mixed-model-repository	tests/benchmarks/test_scan_benchmarks.py::test_scan_release_candidate_repository	release-candidate	547.3 KiB	32	468.73ms	469.23ms	+0.1%	stable

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0c6bef9b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

The implementation and focused QA are clean: tests/scanners/test_oci_layer_scanner.py passes all 123 tests on the integrated tree, with Ruff, format, and mypy clean; all review threads are resolved and the published head's CI is green.

The only remaining blocker is a one-line CHANGELOG.md merge conflict with current main (e22f4e1736fb8ad86e4254e5f6db60df37ec6976). The correct resolution retains both adjacent entries under [Unreleased]:

• scan safe OCI layer links with model-looking member names instead of treating link metadata as complete coverage
• fail closed on JFrog folder downloads whose selected artifacts use unsafe, colliding, or overlapping local paths

Local resolved merge tree: 963839f7de995df36aada5dcba070ae548c71795. Shell push credentials are unavailable in this environment.

@codex please sync current main into this PR, resolve CHANGELOG.md by retaining both entries exactly as above, and push the branch.

[chatgpt-codex-connector]

Summary

• Resolved the CHANGELOG.md conflict by retaining both requested adjacent [Unreleased] bug-fix entries exactly as specified: the OCI layer link scanning entry and the JFrog folder download safety entry. CHANGELOG.mdL8-L14
• Committed the change locally as 34f7170 chore: resolve changelog conflict.
• Attempted to fetch/push against https://github.com/promptfoo/modelaudit.git, but this environment cannot reach GitHub (CONNECT tunnel failed, response 403), so I could not push the branch from here.

Testing

• ✅ uv run ruff format modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• ✅ uv run ruff check --fix modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• ✅ uv run mypy modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• ✅ PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest tests/scanners/test_oci_layer_scanner.py -q
• ⚠️ PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -n auto -m "not slow and not integration" --maxfail=1 — started but terminated after extended runtime before completion in this environment.

View task →

[mldangelo-oai]

Integrated current main and pushed 630a7a005269da1f5975fe0387a298fc0e6eb516. The merge conflict was substantive: main's cumulative extraction budgets and this PR's resolved-link helper overlapped. The final helper now charges every actual regular/link payload copy against both per-layer and whole-manifest budgets.

The critical audit also found quadratic link-chain resolution. Resolutions are now path-compressed through a per-layer cache; a 256-link regression verifies resolving every alias performs exactly 256 target-resolution steps rather than O(n^2) work.

Focused QA: all 143 OCI scanner tests pass, with scoped Ruff, format, mypy, and git diff --check clean. All existing review threads remain resolved. A valid cross-layer symlink still fails closed because correct support requires an overlay-aware path index with OCI whiteout semantics; that limitation is now explicit in the PR body rather than being mistaken for same-layer coverage.

[mldangelo-oai]

@codex Please sync the latest main commit f856f9c341c886501582846f204f806c91d4d971 into this PR and push the branch. The merge is clean and changes only the newer Keras files from main; there are no OCI conflicts.

Exact local integrated head: 675db3b9c6813b6aeb9075abae2a12f0b5db3ee9.

Critical review of the current OCI link resolver found no remaining same-layer false-positive/false-negative defect: target resolution is confined to admitted metadata-valid members, duplicate normalized paths stay ambiguous, absolute symlinks use OCI root semantics, payload copies are charged to per-file/per-layer/manifest budgets, and link-chain resolution is path-compressed. The documented cross-layer limitation still fails closed.

Focused validation after merging latest main: tests/scanners/test_oci_layer_scanner.py = 143 passed; targeted Ruff check/format, mypy, and git diff --check clean. All review threads are resolved. Python CI on the published head was still in progress when reviewed.

[chatgpt-codex-connector]

Summary

• Applied the latest main Keras truthiness changes from commit f856f9c341c886501582846f204f806c91d4d971 on top of the OCI PR work, committed locally as 679e2f7 test: sync keras truthiness coverage from main.
• Updated CVE-2025-12060 explanation text to describe truthy untar and tar-capable extract semantics.
• Updated the Keras ZIP scanner’s CVE-2025-12060 description to match the broadened truthiness semantics.
• Added regression coverage for truthy kwargs/positional get_file extraction arguments and false-like non-detection cases.
• Attempted to push HEAD:mdangelo/codex/fix-oci-layer-link-validation, but shell GitHub access is blocked in this environment with CONNECT tunnel failed, response 403.

Testing

• ✅ uv run ruff format modelaudit/config/explanations.py modelaudit/scanners/keras_zip_scanner.py tests/scanners/test_keras_zip_scanner.py
• ✅ uv run ruff check --fix modelaudit/config/explanations.py modelaudit/scanners/keras_zip_scanner.py tests/scanners/test_keras_zip_scanner.py
• ✅ uv run mypy modelaudit/config/explanations.py modelaudit/scanners/keras_zip_scanner.py tests/scanners/test_keras_zip_scanner.py
• ✅ PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -q tests/scanners/test_oci_layer_scanner.py
• ✅ PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest -q tests/scanners/test_keras_zip_scanner.py -k 'get_file_truthy_extraction_argument_forms or get_file_false_like_extraction_argument_forms or get_file_truthy_extraction_arguments_detect_cve_2025_12060'
• ✅ git diff --check
• ⚠️ git fetch origin main / git push origin HEAD:mdangelo/codex/fix-oci-layer-link-validation — blocked by environment GitHub proxy failure: CONNECT tunnel failed, response 403.

View task →

[mldangelo-oai]

Random critical review completed and current main was merged into the branch at 4e5de6863ecf6b9cb094a10c3ba0df8a54fd907b (exact tested tree 4fd70a3a2c689be5d2ebb5d583fba016b5dfba2c).

False-positive / false-negative audit found no remaining same-layer defect: link resolution is restricted to admitted metadata-valid targets, duplicate normalized targets remain ambiguous, absolute symlinks use OCI root semantics, payload copies are charged to per-file/layer/manifest budgets, equivalent aliases are deduplicated by payload plus routing suffix, and unresolved cross-layer targets still fail closed.

Focused QA:

• complete OCI scanner module: 143 passed
• independent randomized resolver oracle: 5,000 graphs passed
• path-compression stress: 10,000-link chain resolved in 0.26s
• repository Ruff format/check, full mypy (464 source files), and git diff --check: clean

All review threads were already resolved. Full pytest remains delegated to CI as requested.

[mldangelo-oai]

Critical follow-up found and fixed two remaining link-resolution defects. First, the path-compression cache was keyed by normalized link name, so duplicate link headers with the same path but different targets could make the second reuse the first payload. It is now keyed by the actual TarInfo. Second, exact-name-only lookup falsely rejected valid same-layer paths through an intermediate directory symlink; resolution now walks admitted symlink components under the same containment and cycle guards. New regressions cover both cases. Complete associated OCI module: 145 passed; scoped Ruff/format/mypy/diff checks are clean. Exact tree: d22570e503fe2d21e42173be540e63933684096d.

[mldangelo-oai]

Critical follow-up review found an algorithmic denial-of-service path in component-directory symlink traversal: N directory links combined with N distinct model aliases could require O(N²) resolver work (for example, 200 + 200 entries produced 40,200 path-resolution calls before the fix).

Fixed in 638c7df07c7387a46ed0d7c5abb0508b8f5e2f5e by sharing a linear per-layer resolution budget and memoizing only complete resolved member paths. Exhaustion now fails closed with Layer Link Resolution Budget Check / oci_link_resolution_limit_exceeded. Exact-path cache regressions cover both cycle and rewrite cases so one suffix cannot poison a benign sibling.

Associated QA: all 149 OCI scanner tests pass; scoped Ruff, format, mypy, and diff checks are clean. The final published tree is 69079ef35c8a66d8fa38af71bfd447db1bb24466.