engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave27 survey: 10 clean-scan additions (8th full-clean wave)

Browse source 
yarn, pnpm, lerna, nx, turborepo, tcl, gawk, gnuplot, coreboot, openocd
all clean. Honor roll cumulative: 184 projects.

Package managers bounded by manifest dep graph. Firmware projects
bounded by fixed adapter/board tables. Scripting languages bounded by
language grammar.
This commit is contained in:
russell@unturf.com 2026-04-25 18:23:57 -04:00
parent 63bfcebcf5
commit e1716b98b4
No known key found for this signature in database
1 changed files with 77 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

77
whitepaper/outreach/wave27-pkg-build-script-firmware-survey.md Normal file
View file

@ -0,0 +1,77 @@
# Wave 27 — Package Managers, Monorepo Build, Scripting, Firmware
**Survey date:** 2026-04-25
**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter)
**Scope:** 10 projects across Node package managers (yarn, pnpm), monorepo build (lerna, nx, turborepo), scripting languages (tcl, gawk), plotting (gnuplot), firmware (coreboot), and JTAG debugger (openocd).
---
## Summary
Wave 27 totals 1,696 HIGH+ findings across 10 projects. **Ten new clean-scan honor roll entries** (eighth full-clean wave). Honor roll cumulative: **184 projects** across waves 3-27.
**No flagship CWE-407 patches ship this pass.** Package managers cluster their `.includes()` calls in per-package dependency-tree walks bounded by manifest size. Firmware projects (coreboot, openocd) cluster theirs in CLI argv parsing and fixed adapter/board name tables.
## Clean-scan honor roll — 10 new entries
| Project | Lang | Role | Notes |
|---------|------|------|-------|
| **lerna** | TS | Monorepo manager | 20 findings: `get-cycles.ts` `path.includes(dep)` is per-dependency cycle detection (bounded by dep depth), bounded fixed cacheable-operations enum. **clean** |
| **gawk** | C | GNU awk | 50 findings: `command.c` debug command parser, `awkgram.c` switch case_values fixed lookup, `debug.c` source/breakpoint name matching. Bounded by awk language grammar. **clean** |
| **yarn** | JS | Node package manager (Berry) | 56 findings: `package-request.js` resolver bounded by deps, `install.js` excludeNames per CLI flag (small fixed list), package-linker realLocations bounded by workspace size. **clean** |
| **tcl** | C | Tool Command Language | 82 findings: `tclDate.c` month/day/timezone name lookup (fixed bit per language spec), `tclCmdMZ.c` `-nocase`/`-length` flag parsing, `tclIO.c` channel type "tcp" check. **clean** |
| **gnuplot** | C | Plotting program | 106 findings: `datafile.c` "+"/"++" pseudo-filename check, `command.c` terminal name lookup (qt/pm/eps/kitty — fixed terminal driver list ~20), `term.c` output format fixed lookup. **clean** |
| **pnpm** | TS | Performant Node pkg manager | 111 findings: `createRegistryServer.ts` contentType.includes('ndjson') is single-string substring check; `pendingBuilds.includes(id)` bounded by builds in flight (typically <100); `automaticallyIgnoredBuilds` is the user-configured allowlist (small). **clean** |
| **openocd** | C | JTAG debug + flash programming | 112 findings: `jtag/adapter.c` adapter driver name lookup (fixed list ~30 drivers), `flash/nor/dw-spi.c` board variant flag (`-jaguar2`/`-ocelot` fixed), `server/ipdbg.c` hub name lookup. **clean** |
| **coreboot** | C | x86/arm firmware | 145 findings: `device_tree.c` FDT property name lookup, `util/sconfig/main.c` board option name lookup, `util/marvell/doimage_mv/doimage.c` BIN/REG fixed image-section types. All bounded by board-spec config size. **clean** |
| **turborepo** | TS/Rust | Vercel monorepo build | 379 findings: 221 M1 mostly UI (turbo dashboard) + bounded build-config patterns; 140 M7 in `crates/turborepo-lib/src/run/` for graph traversal (intentional task-graph algorithms). **clean** |
| **nx** | TS | Smart monorepo build | 535 findings: 436 M1 mostly per-project task-graph patterns bounded by workspace size, plus codemods. Tight UI/build-time cluster. **clean** |
Honor roll now stands at **184 projects** validated zero-real-finding under MOAD-0001 scanning.
## Per-target findings
| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage |
|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------|
| **nx** | TS | 535 | 436 | 26 | 16 | 2 | 1 | 53 | - | 1 | Per-project task-graph bounded. **clean** |
| **turborepo** | TS/Rust | 379 | 221 | - | 16 | - | 1 | 140 | - | 1 | Task-graph traversal algorithms. **clean** |
| **coreboot** | C | 145 | 135 | - | 7 | - | - | 2 | - | 1 | Device-tree + board config. **clean** |
| **openocd** | C | 112 | 108 | - | 3 | - | - | 1 | - | - | JTAG adapter + flash chip names. **clean** |
| **pnpm** | TS | 111 | 68 | - | 4 | 11 | 28 | - | - | - | Bounded build set. **clean** |
| **gnuplot** | C | 106 | 90 | - | 14 | - | - | 2 | - | - | Terminal driver names + datafile syntax. **clean** |
| **tcl** | C | 82 | 80 | - | 2 | - | - | - | - | - | Date format + channel types + flags. **clean** |
| **yarn** | JS | 56 | 48 | - | 1 | 1 | 4 | 1 | - | 1 | Resolver bounded by manifest deps. **clean** |
| **gawk** | C | 50 | 44 | - | 6 | - | - | - | - | - | awk grammar fixed tokens. **clean** |
| **lerna** | TS | 20 | 12 | - | 2 | - | 6 | - | - | - | Cycle detection bounded. **clean** |
## Investigation notes
### Package managers (yarn, pnpm, lerna, nx, turborepo) — bounded by manifest
Every Node package manager / monorepo build tool clusters its `Array.includes()` calls in per-package dependency walks. The bound here is the size of the user's `package.json` graph — for typical workspaces 10s of packages, for monorepos 100s. None hit pathological scale.
### tcl/gawk/gnuplot — fixed language-spec tables
These are interpreters/parsers with FIXED grammar/syntax tables compiled into the binary. tclDate's month-name lookup checks against 12 entries, gnuplot's terminal-driver lookup against ~20 entries, gawk's case-value sweep is per-switch-statement bounded by source code shape.
### coreboot/openocd — board-spec bounded
Both firmware projects look up board names, adapter names, flash chip names against fixed compile-time tables of the supported hardware (10s to 100s of board variants). Bounded by hardware coverage at compile time.
## Triage backlog
1. **No new high-value defect candidates surfaced.** Package managers and firmware projects use bounded dictionaries throughout. The interesting flagship territory continues to be in:
- Reverse-engineering tools (ghidra-0001, ghidra-0002 shipped)
- Analytics dashboards with multi-key joins (ghost-0001 shipped)
- Distributed-system filter paths with user-scaled inputs (weaviate-0001, pyroscope-0001 shipped)
2. **Scanner enhancements continue to be the highest leverage** — the 100+ FPs per wave from Java declared-type Set/EnumSet, Rust bitflags, JUnit ExtensionContext, codegen artifacts, vendored UI trees would clear thousands of findings if implemented.
## Method
Same as Waves 3-26: shallow clone, `unmoad -s high -f json`, filter test/vendor/codegen noise, manual triage of strongest source-only candidates per project. **Ten projects added to clean-scan honor roll** (eighth full-clean wave). No new UNDF IDs assigned (no patches shipped).
## References
- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com`
- Earlier surveys: `/test-harness-survey/` through `/wave26-middleware-cms-cm-editor-pdf-cli-viz-survey/`
- Clean-scan honor roll cumulative: 184 projects across waves 3-27