keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

//! Versioned on-disk autoroute cache schema.

use serde::{Deserialize, Serialize};

use super::super::evidence::AutorouteDecision;
use super::super::host::AutorouteHostProfile;
use super::super::workload::WorkloadKey;

/// Minimal front matter parsed before the version-specific payload.
#[derive(Deserialize)]
pub(crate) struct AutorouteCacheVersionEnvelope {
    #[serde(default)]
    pub(super) version: u32,
}

/// Artifact family used by every measured GPU route in this generation.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
pub(crate) enum AutorouteGpuArtifactBinding {
    /// Programs compiled from this exact executable and detector corpus.
    RuntimeCompiled {
        executable_sha256: String,
        rules_digest: String,
    },
    /// Installer-owned GPU artifacts authenticated by their manifest digest.
    InstalledSidecar { sha256: String },
}

/// On-disk autoroute calibration cache. Only build and corpus identity is shared.
/// Each exact `(resolved scan configuration, host)` generation owns its routes.
#[derive(Debug, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct AutorouteCache {
    pub(crate) version: u32,
    pub(crate) binary_version: String,
    pub(crate) git_hash: String,
    pub(crate) executable_sha256: String,
    pub(crate) build_features: AutorouteBuildFeatures,
    pub(crate) detector_digest: u64,
    pub(crate) rules_digest: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) gpu_artifact_binding: Option<AutorouteGpuArtifactBinding>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub(crate) execution_pack_generation:
        Option<crate::execution_pack_install::ExecutionPackGenerationBinding>,
    pub(crate) configs: Vec<AutorouteConfigDecisions>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct AutorouteConfigDecisions {
    pub(crate) config_digest: u64,
    pub(crate) host: AutorouteHostProfile,
    pub(crate) decisions: Vec<PersistedAutorouteDecision>,
}

impl AutorouteConfigDecisions {
    pub(super) fn matches_generation(
        &self,
        config_digest: u64,
        host: &AutorouteHostProfile,
    ) -> bool {
        self.config_digest == config_digest && &self.host == host
    }
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct PersistedAutorouteDecision {
    pub(crate) workload: WorkloadKey,
    pub(crate) decision: AutorouteDecision,
    pub(crate) workload_digest: [u8; 32],
}

#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub(crate) struct AutorouteBuildFeatures {
    pub(crate) cli_features: Vec<String>,
    pub(crate) scanner_features: Vec<String>,
    pub(crate) sources_features: Vec<String>,
    pub(crate) verifier_features: Vec<String>,
}