Fix security_scan remote/VM checksum module require failure - #226
Merged
Conversation
The checksum-verification module added in v5.22.0 is pulled in via require_once dirname(__FILE__) . '/checksum-verify.php', which only resolves when PHP runs the scanner file directly off disk. security_scan's remote (SSH) and Trellis-VM paths instead stream the scanner source over `php /dev/stdin`, where __FILE__ resolves to a pipe/fd path with no real sibling directory, so every remote or VM scan failed with: Fatal error: Uncaught Error: Failed opening required '.../checksum-verify.php' Inline the module's source in place of that require_once line before streaming, so the piped script is self-contained. Local scans (localPath, or running the scanner file directly) were unaffected and need no change. Reproduced and verified the fix by piping both the original and patched scanner source into `php /dev/stdin` directly, matching what runRemote/runVm actually do.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v5.22.0's checksum-verification module broke
security_scanfor every remote (SSH) and Trellis-VM site. Both scanners pull the module in via:That only resolves when PHP runs the scanner file directly off disk.
security_scan's remote and VM paths instead stream the scanner source overphp /dev/stdin(by design — nothing is ever written to disk on the remote host), where__FILE__resolves to a pipe/fd path with no real sibling directory. Every remote or VM scan since 5.22.0 fails with:Confirmed live against a production site over SSH.
Fix
securityScan.tsnow inlineschecksum-verify.php's source in place of thatrequire_onceline before streaming the scanner over stdin, so the piped script is fully self-contained. Local scans (localPath, or running a scanner file directly) were never affected and need no change.Testing
No test harness exists for
mcp-serveryet, so this was verified by reproducing the exact failure mode directly: piping both the original and the patched scanner source intophp /dev/stdin <path>(matching whatrunRemote/runVmactually do). The original source fails with the same "Failed opening required" error reported from production; the patched source runs the full checksum + pattern-scan flow with no error.Fixes the regression from #225 / v5.22.0.