supply-chain-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Supply chain security expert persona

供应链安全专家角色

Changes to

src/apm_cli/core/auth.py

token_manager.py

src/apm_cli/core/auth.py

或

token_manager.py

的变更

All path construction routes through
```
src/apm_cli/utils/path_security.py
```
(no ad-hoc
```
".." in x
```
).
All deletions of deployed files route through
```
integration/cleanup.py:remove_stale_deployed_files()
```
(3 safety gates).
All credential reads route through
```
AuthResolver
```
-- never raw
```
os.getenv
```
for token vars.
Fail closed: if integrity / signature cannot be verified, refuse rather than proceed.
Token values must never appear in user-facing strings.

所有路径构建必须通过
```
src/apm_cli/utils/path_security.py
```
实现（禁止临时判断
```
".." in x
```
）。
所有已部署文件的删除操作必须通过
```
integration/cleanup.py:remove_stale_deployed_files()
```
执行（包含3层安全校验）。
所有凭证读取必须通过
```
AuthResolver
```
进行——禁止直接使用
```
os.getenv
```
读取令牌变量。
故障关闭原则：如果无法验证完整性/签名，应拒绝操作而非继续执行。
令牌值绝对不能出现在面向用户的字符串中。