$ the-wire · showcase
Buffa hardens codegen and descriptor validation, OSS Scanner enrolls WordPress and the AT Protocol stack
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
Buffa closed three long-standing correctness gaps at compile and pool-load time while OSS Scanner added four projects, including WordPress core and both Bluesky AT Protocol implementations, to its enrolment queue.
codegen: validate custom attribute strings as #[...] attributes anthropics/buffa
Custom attribute strings passed to `type_attribute`, `field_attribute`, `message_attribute`, `enum_attribute`, `oneof_attribute` and `oneof_struct_field_attribute` now have to parse as one or more outer `#[...]` attributes via `syn::Attribute::parse_outer`. Before this, they were only checked for balanced delimiters and spliced straight into the generated code, so `serde(skip)` surfaced later a...
fix: validate proto3 extension targets and closed enums anthropics/buffa
`DescriptorPool` was accepting two shapes of proto3 file that protoc rejects: extensions whose extendee is not one of the nine options messages of `descriptor.proto` now raise `PoolError::Proto3ExtensionTargetNotOptions { field, extendee }`, and a proto3 message field or extension typed as a closed enum raises `PoolError::Proto3ClosedEnumField`. Descriptors that load today but would not compile...
Enroll WordPress: WordPress core anthropics/oss-scanner
WordPress core is enrolled as `projects/wordpress`, submitted by maintainer rfaile313 after verifying that `tools/check` builds the project and `tools/validate.py` passes locally. Enrolment means core shows up in the scanner's build and threat-model coverage rather than only in the tracker.
enroll indigo in OSS Scanner anthropics/oss-scanner
Bluesky's `bluesky-social/indigo`, the Go implementation of AT Protocol services and libraries, is now scanned: the job compiles all Go packages, installs every command with CGO enabled, and builds the Relay admin UI, with reports going to `security@bsky.app` and `infra@blueskyweb.xyz` on `auto_ccs`, plus a threat model covering Relay, Tap, Rainbow, moderation tools and identity. Companion enro...
Build the project of an enrolment pull request anthropics/oss-scanner
A new workflow runs `tools/check` on the project an enrolment pull request adds or changes, so a reviewer sees whether its Dockerfile builds without doing it by hand. The workflow and `tools/check` always resolve from the base branch, only the regular files directly inside a single `projects/<name>/` are taken from the pull request, and any other change fails the job, which closes the obvious p...
