Deterministic offline code remediation with ledger-verified replay and template-based patch generation
View Patent ↗Systems, methods, and other embodiments associated with enforcing deterministic code remediation. In one embodiment, a method includes deterministic replay remediation of a computer processable received code having visual or textual information or building block. The method further includes executing at least one run, each executed run including: selecting a remediation template based on at least a portion of the received code, the remediation template having at least one of code remediation data and remediation instructions. The method includes applying the one or more code remediation data or remediation instructions to the received code, and storing the received code applied with the one or more code remediation data or remediation instructions from the remediation template as a processed code. Then the method continues by executing a second run and comparing the processed code from the first and second runs to verify whether they match at a byte level.
1 . A method for deterministic replay remediation and verification of code, comprising:
receiving computer processable code comprising visual or textual information or building block;
executing a first run and a second run, each of the executed first run and second run comprising:
selecting a remediation template based on at least a portion of the received code, the remediation template comprising at least one of code remediation data and remediation instructions,
applying at least one of the code remediation data and remediation instructions to the received code to form a processed code;
determining whether the processed code from the executed first run matches the processed code from the executed second run at a byte level;
processing a request for approving at least one of commit, promotion, patch, merge, deployment, and ledger update using the processed code of the first run when the second run processed code matches byte-for-byte with the first run processed code; and
creating a cryptographic hash associated with the first run processed code and recording an entry on a ledger, wherein the ledger entry comprises at least one of a rule hash, a template hash, a generated patch hash, and a replay verification signature associated with the processed code in each of the first and second runs.
2 . The method of claim 1 , further comprising replacing the received code with the first run processed code, when the second run processed code matches byte-for-byte with the first run processed code.
3 . The method of claim 1 , further comprising applying at least one of the commit, promotion, patch, merge, deployment, and ledger update using the processed code of the first run when the second run processed code matches byte-for-byte with the first run processed code.
4 . The method of claim 1 , further comprising receiving a request to enforce deterministic remediation and code verification for the received code.
5 . The method of claim 1 , further comprising rolling back the first run processed code to the received code when the processed code from the first run and the second run do not match byte-for-byte.
6 . The method of claim 5 , wherein the rollback restores a previous known-good state of the first run processed code and blocks a commit or deployment of the first run processed code from progressing towards approval.
7 . The method of claim 1 , further comprising comparing the remediation template in the second run with the remediation template in the first run.
8 . The method of claim 7 , further comprising storing a violation notification and preventing modification of the received code when the remediation template in the second run does not match the remediation template in the first run.
9 . The method of claim 1 , further comprising storing a violation notification and preventing modification of the received code when the remediation template is not found on either of the first run or the second run.
10 . The method of claim 1 , wherein the remediation template selected in each of the first and second runs is static, rule based, and non-generative, and wherein the remediation template includes data associated with at least one of code analysis and rule evaluation.
11 . The method of claim 1 , wherein the remediation template selected in the second run is the same as the template selected in the first run.
12 . The method of claim 1 , wherein the remediation template is stored offline, and application of at least of the code remediation data and remediation instructions is performed offline.
13 . The method of claim 1 , wherein the remediation template contains a class mapping, and wherein the remediation template is version-pinned, signature-verified, and remains unchanged during each of the first and second runs to ensure future compliance.
14 . The method of claim 1 , wherein the remediation template comprises of rule evaluation data that includes one or more of the following: syntax analysis, abstract syntax tree generation, taint propagation, compliance scoring, and template assignment.
15 . The method of claim 1 , further comprising enforcing deterministic replay remediation and verification through execution of the first and second runs, selection of identical remediation templates in each of the executed first and second runs, byte-for-byte matching, and rolling back the first run processed code to the received code when the processed code from the first run and the second run do not match byte-for-byte.
16 . A non-transitory computer-readable medium that includes stored thereon computer-executable instructions that when executed by at least a processor of a computer cause the computer to:
receive computer processable code comprising visual or textual information or building block;
execute a first run and a second run, each of the executed first run and second run comprising:
selecting a remediation template based on at least a portion of the received code, the remediation template comprising at least one of code remediation data and remediation instructions,
applying at least one of the code remediation data and remediation instructions to the received code to form a processed code;
determine whether the processed code from the executed first run matches the processed code from the executed second run at a byte level;
process a request for approving at least one of commit, promotion, patch, merge, deployment, and ledger update using the processed code of the first run when the second run processed code matches byte-for-byte with the first run processed code; and
create a cryptographic hash associated with the first run processed code and recording an entry on a ledger, wherein the ledger entry comprises at least one of a rule hash, a template hash, a generated patch hash, and a replay verification signature associated with the processed code in each of the first and second runs.
17 . A computing system comprising:
a processor; and
memory in communication with the processor and storing instructions that, when executed by the processor, cause the computing system to:
receive computer processable code comprising visual or textual information or building block;
execute a first run and a second run, each of the executed first run and second run comprising:
selecting a remediation template based on at least a portion of the received code, the remediation template comprising at least one of code remediation data and remediation instructions,
applying at least one of the code remediation data and remediation instructions to the received code to form a processed code;
determine whether the processed code from the executed first run matches the processed code from the executed second run at a byte level;
process a request for approving at least one of commit, promotion, patch, merge, deployment, and ledger update using the processed code of the first run when the second run processed code matches byte-for-byte with the first run processed code; and
create a cryptographic hash associated with the first run processed code and recording an entry on a ledger, wherein the ledger entry comprises at least one of a rule hash, a template hash, a generated patch hash, and a replay verification signature associated with the processed code in each of the first and second runs.
18 . The computing system of claim 17 , further comprising causing the computing system to: replace the received code with the first run processed code, when the second run processed code matches byte-for-byte with the first run processed code.
19 . The computing system of claim 17 , further comprising causing the computing system to: apply at least one of the commit, promotion, patch, merge, deployment, and ledger update using the processed code of the first run when the second run processed code matches byte-for-byte with the first run processed code.
20 . The computing system of claim 17 , further comprising causing the computing system to: receive a request to enforce deterministic remediation and code verification for the received code.