straight.el 패키지 업그레이드에 LLM 기반 보안 심사 적용

(defconst my-straight-install-el-sha256 "e29e07d52d16d4136971f0a822cb6a1a6e1e764a1cb9fe67cccbc7c048aba553")
(defvar bootstrap-version)
(let ((bootstrap-file (expand-file-name "straight/repos/straight.el/bootstrap.el" (or (bound-and-true-p straight-base-dir) user-emacs-directory)))
      (bootstrap-version 7))
  (unless (file-exists-p bootstrap-file)
    (with-current-buffer (url-retrieve-synchronously "https://raw.githubusercontent.com/radian-software/straight.el/develop/install.el" 'silent 'inhibit-cookies)
      ;; verify bootstrap script against its pinned checksum before eval
      (require 'url-http)
      (when url-http-end-of-headers (delete-region (point-min) url-http-end-of-headers) (delete-region (point-min) (progn (skip-chars-forward " \t
") (point))))
      (let ((checksum (secure-hash 'sha256 (current-buffer))))
        (unless (string= checksum my-straight-install-el-sha256)
          (error "straight.el bootstrap checksum mismatch!")))
      (goto-char (point-max))
      (eval-print-last-sexp)))
  (load bootstrap-file nil 'nomessage))

(defun my-straight-incoming-diffs ()
  "Concatenate the full patches of all incoming upstream changes. Create a `diff-mode' buffer listing, for every straight.el checkout that is behind its upstream, the incoming commits with author and date. The buffer is left writable so hunks can be trimmed before feeding it to a reviewing agent."
  (interactive)
  (let* ((repos (magit-list-repos-1 (expand-file-name "straight/repos" user-emacs-directory) 1))
         (behind (seq-filter #'my-straight-repo-behind-p repos)))
    (if (null behind) (message "No incoming upstream changes") (with-current-buffer (get-buffer-create "*straight-incoming-diffs*") (erase-buffer) (dolist (repo behind) (let* ((default-directory repo) (branch (magit-git-string "rev-parse" "--abbrev-ref" "HEAD")) (upstream (magit-git-string "rev-parse" "--abbrev-ref" "@{upstream}")) (commits (magit-git-lines "log" "--format=%h %ad %an %s" "--date=short" "HEAD..@{upstream}")) (n (length commits))) (insert (make-string 80 ?=) "
") (insert (format "%s (%s ;; in ~/.authinfo.gpg and drop the secrets: entry. (setq auth-sources '(\"secrets:kdewallet\" \"~/.authinfo.gpg\" \"~/.authinfo\"))"))))) (display-buffer (current-buffer))))))

(defvar my-gptel-review-system-prompt "You are a meticulous security reviewer auditing third-party code before it is merged or used. The user will show you one or more git diffs, each preceded by the list of incoming commits with author and date. Scan for anything that could act maliciously once merged or called: - backdoors, remote code execution, persistence mechanisms - credential, token, key or data exfiltration (also covert channels) - unexpected network activity, downloads or connections to new hosts - obfuscation designed to hide behavior (heavy encoding, dead stores) - tampering with build, installation or packaging scripts - anomalous commit authorship: new maintainer, changed email address, commits by someone unrelated to the project For every finding, state: severity (high/medium/low), the file and hunk, and a one-paragraph rationale. Close with an overall verdict: whether the changes look safe to merge. If nothing is suspicious, say so plainly and briefly; do not invent findings." "System prompt for `my-gptel-review-malicious-code'.")

(defun my-gptel-review-malicious-code ()
  "Review the region, or the whole buffer, for malicious code. Send the text to the LLM with a security-audit system prompt and show the response in the *gptel-review* buffer."
  (interactive)
  (require 'gptel)
  (let* ((text (buffer-substring-no-properties (if (use-region-p) (region-beginning) (point-min)) (if (use-region-p) (region-end) (point-max))))
         (buffer (get-buffer-create "*gptel-review*"))
         (marker (with-current-buffer buffer (erase-buffer) (org-mode) (goto-char (point-min)) (point-marker))))
    (pop-to-buffer buffer)
    (gptel-request (format "Review the following content from %s for malicious code or \ exploits.

%s" (buffer-name) text) :system my-gptel-review-system-prompt :stream t :buffer buffer :position marker)))