many: limit inspector access to artefact metadata
Metadata
Current evaluation
Merged PR #140 in commit 19fd664, adding request/response interfaces that restrict inspectors to authorized artefact metadata updates and prevent invalid opinion states.
Resolution: closed resolved
Reason: PR canonical/fetch-service#140 was approved and merged as commit 19fd664. It shields artefact metadata behind interfaces and enforces metadata updates through a single call, blocking arbitrary mutation by inspectors.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Pass interfaces corresponding to requests and response artefacts
to inspector methods to prevent inspectors from modifying arbitrary
data and setting invalid states in inspection opinions.
This also enforces artefact metadata to be set in a single call,
making it harder to unintentionally fill metadata fields for an
artefact the inspector has no authority over.
Signed-off-by: Claudio Matsuoka <claudio.matsuoka@canonical.com>
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #140 in commit 19fd664, adding request/response interfaces that restrict inspectors to authorized artefact metadata updates and prevent invalid opinion states. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #140 as commit 19fd664, shielding artefact metadata behind request/response interfaces and restricting metadata updates to single calls. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #140 in commit 19fd664, shielding artefact metadata behind request/response interfaces and limiting inspectors to single-call metadata updates. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/fetch-service#140 (commit 19fd664), adding request/response interfaces that shield artefact metadata from inspector mutation and constrain metadata updates to a single call. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after two approvals and CI. Refactored inspector access to artefact metadata via interfaces to prevent arbitrary modifications and enforce single-call setting. Enhances API safety and readability without functional changes. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #82 metadata,inspectors: refactor artefact inspection interface | fetch-service | merged | Merged PR #82 in commit a05ab1e, splitting request/response inspection methods, removing redundant APIs and attributes, and moving opinions to a dedicated package. | |
| #41 inspectors: add request opinions | fetch-service | merged | Merged request inspection opinions via PR #41 (commit f687096), adding metadata support for placing artefacts in a pending-verification state. | |
| #26 inspectors: validate artefacts using opinions | fetch-service | merged | Merged PR #26 (commit b0e6cac) replaced single-format inspection with an opinion-based scheme: all inspectors examine related formats and emit opinions; an artefact is validated only if every capable inspector approves. Fixes fetch-service#23 (CRAFT-2114). |