GaspardMerten/microsegments

Review signals: 46 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 46 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• microsegments cuts each line into 30 m stretches and counts observations per stretch: Real input produced the expected result: 538 segments

  Source: `microsegments` cuts each line into short stretches (30 m by default)

  Input: examples/synth.toml synthetic tram line

  Expected: run reports 538 segments

  Command: <guest-path> run examples/synth.toml -o <guest-path>

  Observed: 538 segments, 5 hotspots (read 0.2s coverage 0.2s network 0.2s place 0.4s passages 0.4s count 0.1s analyse 0.1s hotspots 0.1s)

Examples

• documented STIB 55 example runs on the two-day test fixture: command completed successfully

  Source: examples/stib55.toml header: microsegments run examples/stib55.toml -o out/stib55

  Input: examples/stib55.toml

  Expected: analysis and report written to output directory

  Command: <guest-path> run examples/stib55.toml -o <guest-path>

  Observed: ib55/out/analysis.json <guest-path> <guest-path> <guest-path> observations: 78,799 rows GTFS calendar does not cover 2 date(s) (2025-03-18..2025-03-19): using the same weekday of the feed (2025-04-14..2025-05-11) network: 9 patterns over 2 dates placed: 98,407 rows analysis: 2 days included, 0 excluded hotspots skipped: too_few_days: 2 included days < 5 (quality.min_days, floor 5) done: 2 days, 1303 segments, 0 hotspots (read 0.1s coverage 0.1s network 0.2s place 0.2s passages 0.2s count 0.1s analyse 0.1s)

Local or hosted: local

Run the documented microsegments pipeline on the offline synthetic tram line and the STIB 55 example, producing result, analysis, report and matrix files

cd <guest-path> && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -200
cd <guest-path> && git status 2>&1 | head -3; ls /inputs 2>&1; echo CDP=$CDP_URL $<env-var>
cd <guest-path> && git init -q && git remote add origin https://github.com/GaspardMerten/microsegments && git fetch --depth 1 origin ceada544d6c01c212850253a531c5ca8e473601d 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; ls .coldpass; cat .gitignore; ls examples tests; cat examples/make_synth.py | head -30
cd <guest-path> && python3 -m venv <guest-path> 2>&1 | tail -3; <guest-path> install -q --upgrade pip 2>&1 | tail -2; <guest-path> install "<guest-path>" 2>&1 | tail -5; <guest-path> --help 2>&1 | head -20
cd <guest-path> && <guest-path> examples/make_synth.py 2>&1 | tail -3 && <guest-path> run examples/synth.toml -o <guest-path> 2>&1 | tail -15; ls <guest-path> 2>&1; cat examples/synth.toml
cd <guest-path> && rm -rf <guest-path> && <guest-path> hotspots examples/synth.toml -o <guest-path>; echo rc=$?; ls -la <guest-path>; head -c 400 <guest-path>; echo; grep -rn "cron\|schedule\|while True\|--once\|webhook" src/ | head; ls docs
cd <guest-path> && rm -f <guest-path> && mkdir -p <guest-path> && <guest-path> run examples/stib55.toml -o <guest-path> 2>&1 | tail -4; echo rc=$?; head -5 examples/stib55.toml; ls tests/fixtures | head
cd <guest-path> && rm -rf <guest-path> <guest-path> <guest-path> <guest-path> && mkdir -p .coldpass <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["microsegments","run","examples/synth.toml","-o","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"538 segments"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"microsegments cuts each line into 30 m stretches and counts observations per stretch","source":"`microsegments` cuts each line into short stretches (30 m by default)","input":"examples/synth.toml synthetic tram line","expected":"run reports 538 segments","probe_kind":"cli","argv":["microsegments","run","examples/synth.toml","-o","<guest-path>"],"expected_text":"538 segments","cwd":"<guest-path>","output_directory":"<guest-path>"},
{"kind":"claim","claim":"hotspots exports GeoJSON","source":"`microsegments hotspots CONFIG -o hotspots.geojson`","input":"examples/synth.toml","expected":"GeoJSON file contains hotspot stretch Charlie","probe_kind":"cli","argv":["microsegments","hotspots","examples/synth.toml","-o","<guest-path>"],"expected_file":"<guest-path>","expected_text":"\"from_stop_name\": \"Charlie\"","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"documented STIB 55 example runs on the two-day test fixture","source":"examples/stib55.toml header: microsegments run examples/stib55.toml -o out/stib55","input":"examples/stib55.toml","expected":"analysis and report written to output directory","argv":["microsegments","run","examples/stib55.toml","-o","<guest-path>"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"<guest-path>"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (README CLI section, src/microsegments CLI commands run/tune/hotspots/inspect/compare/sensitivity-table). The package is a one-shot batch pipeline with no scheduler, cron, daemon, loop, webhook or --once/--now trigger; the only while-loop found is in network/keys.py and is not a product cycle. It is run on demand by the user.","checks":[]}
EOF
for f in .coldpass/*.json; do python3 -m json.tool $f >/dev/null && echo ok $f; done; ls <guest-path>
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && rm -rf <guest-path> <guest-path> && python3 - <<'EOF'
import json,pathlib
EXE="<guest-path>"
def fix(obj):
    if isinstance(obj,dict):
        if isinstance(obj.get("argv"),list) and obj["argv"] and obj["argv"][0]=="microsegments":
            obj["argv"][0]=EXE
        for v in obj.values(): fix(v)
    elif isinstance(obj,list):
        for v in obj: fix(v)
for f in [".coldpass/probe.json",".coldpass/claims.json",".coldpass/examples.json"]:
    p=pathlib.Path(f); d=json.loads(p.read_text()); fix(d); p.write_text(json.dumps(d,indent=1,ensure_ascii=False)+"\n")
    print(f, "ok")
EOF
grep -n argv .coldpass/*.json | head; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && grep -rn "geojson" src/microsegments/cli*.py src/microsegments/*.py 2>/dev/null | grep -i "suffix\|endswith\|ext" | head; grep -rln "def main" src/microsegments | head; ls <guest-path>
cd <guest-path> && rm -rf <guest-path> <guest-path> <guest-path> <guest-path> && mkdir -p <guest-path> && python3 - <<'EOF'
import json,pathlib
EXE="<guest-path>"
p=pathlib.Path(".coldpass/claims.json"); c=json.loads(p.read_text())
c=[x for x in c if x["claim"]!="hotspots exports GeoJSON"]
p.write_text(json.dumps(c,indent=1,ensure_ascii=False)+"\n")
q=pathlib.Path(".coldpass/probe.json"); d=json.loads(q.read_text())
d["expected_text"]="<guest-path>"
q.write_text(json.dumps(d,indent=1,ensure_ascii=False)+"\n")
print(len(c),"claims")
EOF
rmdir <guest-path>; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json;d=json.loads(sys.stdin.read());print(d['valid'],d['problems']);r=d['replay'] if 'replay' in d else {};print(json.dumps({k:v for k,v in r.items() if k!='details'})[:500])" 2>&1 | tail -20
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json;d=json.loads(sys.stdin.read());r=d['replay'];print(d['valid'],r['status'],r['details'].get('working'),r['details'].get('returncode'),[ (c['verdict']) for c in r['claims']],[e['verdict'] for e in r['example_checks']])"; mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the documented microsegments pipeline on the offline synthetic tram line and the STIB 55 example, producing result, analysis, report and matrix files","operation_scope":"Python 3.12 venv at <guest-path> with pip install of the pinned checkout with the [plot] extra; offline synthetic data from examples/make_synth.py; no credentials or browser needed","steps":["git init; git remote add origin https://github.com/GaspardMerten/microsegments; git fetch --depth 1 origin ceada544d6c01c212850253a531c5ca8e473601d; git reset --mixed FETCH_HEAD","python3 -m venv <guest-path>; <guest-path> install \"<guest-path>\"  (README: pip install \"microsegments[plot]\", installed from the pinned local checkout)","python examples/make_synth.py (generates examples/data)","microsegments run examples/synth.toml -o out/ (executed as <guest-path>)","microsegments hotspots examples/synth.toml -o hotspots.geojson (run manually; output printed hotspot table and wrote GeoJSON)","microsegments run examples/stib55.toml -o out/stib55 (README linear-referenced example)"],"deviations":["Installed from the pinned local checkout instead of PyPI so the pinned commit is what is tested.","Used the absolute venv executable <guest-path> in all saved argv, because the checker does not activate the venv and bare 'microsegments' was not found on PATH.","Hotspot GeoJSON claim was removed from claims.json: the checker appends a '-checker-<id>' suffix to -o destinations, so the product's out.suffix == '.geojson' check (src/microsegments/cli.py:77) fails and the file is written as parquet. This is a harness artifact; the export works when run manually with a plain .geojson path.","Probe expected_text uses a stdout path because the probe checks stdout only; the '538 segments' text is in stderr and is verified by the README claim instead."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Harness: do not append a suffix to -o file destinations (or keep the extension last) so the product's extension-based output format is preserved. No product change needed."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo report ok; ls -la .coldpass