Skip to content

fix: pin the revision of a teeclave-trustzone-sdk crate - #1356

Open
alekseifedotov wants to merge 1 commit into
mainfrom
aleksei/fix-teechave-revision
Open

fix: pin the revision of a teeclave-trustzone-sdk crate#1356
alekseifedotov wants to merge 1 commit into
mainfrom
aleksei/fix-teechave-revision

Conversation

@alekseifedotov

@alekseifedotov alekseifedotov commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

crate teeclave-trustzone-sdk uses tfh branch on fork of an upstream project. Pin its revision to protect from supply chain attacks.

@alekseifedotov
alekseifedotov requested a review from a team as a code owner August 20, 2026 18:14
@alekseifedotov
alekseifedotov force-pushed the aleksei/fix-teechave-revision branch 2 times, most recently from 3f61dd8 to a1b6ac9 Compare August 20, 2026 18:15
@alekseifedotov
alekseifedotov requested a lite review from Copilot August 20, 2026 18:16
@github-actions

Copy link
Copy Markdown
  • Cargo.toml:247: Update Cargo.lock alongside this change. Its source still contains ?branch=tfh, while the manifest now requests ?rev=…; Cargo treats these as different source IDs, so frozen/locked builds—including the release workflow—will reject the stale lockfile.

@alekseifedotov alekseifedotov changed the title fix: pin the revision of a crate fix: pin the revision of a teeclave-trustzone-sdk crate Aug 20, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Pins the git source of the optee-teec-sys crates.io patch to a specific commit in the TheButlah/teaclave-trustzone-sdk fork, reducing supply-chain risk from a moving branch reference.

Changes:

  • Replaces a moving branch = "tfh" patch with a fixed rev = "2b6ca05f8b38496c201cf635032dcce3cfedb3d7".
  • Adds an inline comment documenting why the revision is pinned.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@alekseifedotov
alekseifedotov force-pushed the aleksei/fix-teechave-revision branch from a1b6ac9 to c621d3a Compare August 20, 2026 18:18
@github-actions

Copy link
Copy Markdown

No concrete issues found. The PR correctly pins optee-teec-sys to the same revision already present in Cargo.lock.

crate 'teeclave-trustzone-sdk'  uses 'tfh' branch on fork of an upstream project. Pin its 'rev' to protect from supply chain attacks.
@alekseifedotov
alekseifedotov force-pushed the aleksei/fix-teechave-revision branch from c621d3a to 11ffe2c Compare August 21, 2026 16:36
@github-actions

Copy link
Copy Markdown

No concrete correctness, security, or regression issues found. The manifest pins the intended commit, and Cargo.lock is updated consistently.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants