Add a regression test for license redaction in the audit log
This commit adds changes to assert that every audit entry for `truenas.license.upload` records the redaction placeholder in place of the license, so that dropping `Secret[...]` from the field cannot quietly reopen the leak while CI stays green.
The test uploads nothing and is read-only. Whatever installed the license -- CI, TrueNAS Connect or an operator -- already went through the audited API and left the entry behind, so the entries themselves are what get inspected, and it skips when nothing has called the method. It asserts the shape of the placeholder rather than its exact text, which keeps it independent of how long the placeholder is and holds for a legacy base64 blob as much as for a v2 PEM: a legacy blob carries no PEM header, so matching on one would let a leaked legacy license through.
Add a regression test for license redaction in the audit log
This commit adds changes to assert that every audit entry for `truenas.license.upload` records the redaction placeholder in place of the license, so that dropping `Secret[...]` from the field cannot quietly reopen the leak while CI stays green.
The test uploads nothing and is read-only. Whatever installed the license -- CI, TrueNAS Connect or an operator -- already went through the audited API and left the entry behind, so the entries themselves are what get inspected, and it skips when nothing has called the method. It asserts the shape of the placeholder rather than its exact text, which keeps it independent of how long the placeholder is and holds for a legacy base64 blob as much as for a v2 PEM: a legacy blob carries no PEM header, so matching on one would let a leaked legacy license through.
[flang][NFC] Allow simplify-region-lite to run on any op (#220698)
The pass only walks the regions of getOperation(). Pinning it to
ModuleOp forced a single liveness lattice over the whole compile unit
and blocked scheduling it under a nested pass manager. Drop the
ModuleOp constraint so callers can run it per IsolatedFromAbove op.
Existing module-level addPass() uses are unchanged.
Add a regression test for license redaction in the audit log
This commit adds changes to pin the redaction of the license argument to `truenas.license.upload`, so that dropping `Secret[...]` from the field cannot quietly reopen the leak while CI stays green.
The call is made unauthenticated on purpose. The audit entry is written before the method body runs, so the test never reads, replaces or rolls back an installed license, and it needs no license, HA or enterprise to exercise the redaction. It skips on releases that still expose `system.license_update` instead, since that method carries no audit string.
[offload][nfc] Extract libomptarget infrastructure into libompaccsupport (#213784)
libompaccsupport will become the support library for both OpenMP and
OpenACC. This patch extracts the files that will become part of it.
Currently it only moves the files and the build configuration is
unchanged.
Next patches will start refactoring libompaccsupport to flesh out the
subset of the infrastructure that will be shared between OpenMP and
OpenACC in small verifiable chunks while maintaining libomptarget's
existing behaviour.
Gradually adding the libacctarget implementation that uses
libompaccsupport will also follow.
[VPlan][Predicator] Preserve some uniform control flow
Implements "Partial Control-Flow Linearization" by Simon Moll and
Sebastian Hack.
That should allow implementation of an alternative to
https://github.com/llvm/llvm-project/pull/141900 based on this
functionality (see BOSCC in the paper).
[VPlan] Use compact RPOT instead of just RPOT
This is necessary for the future partial linearization change, but I
wanted to commit this bit independently because it changes some tests on
itself and could potentially provide more blend optimization
opportunites (at least I hoped) but that didn't seem to happen.
Merge tag 'hardening-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening fix from Kees Cook:
- Default randstruct off with rust for better allmodconfig coverage
(Mark Brown)
* tag 'hardening-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
hardening: Default randstruct off with rust for better allmodconfig support
