{{ message }}
Repository navigation
fix(security): fail-closed signature check in the launchers; replace checksum CI jobs [DEVA11Y-474] - #47
Merged
Crash0v3rrid3 merged 2 commits intoOct 21, 2026
Conversation
…checksum CI jobs [DEVA11Y-474] The bash/zsh/fish launchers verified the CLI against a <asset>.sha256 sidecar that the CDN never publishes, and proceeded unverified when it was missing or malformed: the same bypass Security reopened DEVA11Y-473 over. Replace verify_binary_integrity with verify_binary_signature, mirroring the SwiftPM plugin (#46): on macOS, `codesign --verify --strict` against a Developer ID requirement pinned to Team YQ5FZQ855D, run on the extracted binary before chmod/publish. Failure refuses to run and drops the cached zip so the next run re-downloads instead of re-extracting the same payload after a 304. Linux is unsigned and passes through (accepted risk, DEVA11Y-473); any other OS is refused. CI: replace the two checksum jobs, which asserted the fail-open behaviour and waited on sidecars that will never ship, with tests/launcher-signature/run_tests.sh: - matrix: each launcher's function accepts the real CLI and refuses flipped-byte, ad-hoc-signed, unsigned and missing binaries; - published: the latest macOS arm64/x64 releases satisfy the Team-pinned requirement, so a re-signed release turns CI red first. Self-update .sha256 files regenerated for the edited launchers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ate case [DEVA11Y-474] The suite lifted verify_binary_integrity by name, which no longer exists, and drove download_binary with OS=macos and unsigned fixtures that the new signature check refuses before the guard's outcome is observable. Run the guard cases with OS=linux, where the real verify_binary_signature passes through by design, so they still execute only real code. Add case 9 (macOS): the real codesign check must refuse an unsigned payload with exit 2, remove the staged binary and the zip, and leave an existing cached binary intact. 75/75 locally. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Crash0v3rrid3
merged commit Oct 21, 2026
445fa50
into
fix/DEVA11Y-473-fail-closed-checksum
8 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The bash/zsh/fish launchers (
scripts/*/cli.sh) verified the CLI against a<asset>.sha256checksum file that the CDN never publishes. When that file was missing or malformed they ran the binary unverified: the same fail-open behaviour Security reopened DEVA11Y-473 over. Security's condition 3 on DEVA11Y-473 (comment 2471198) requires the launchers to get the same signature checks as the plugin.Two CI jobs in
spm-smoke-test.ymlencoded the old design:What
Launchers.
verify_binary_integrityis replaced byverify_binary_signature, identical in all three copies:codesign --verify --strictwith the same Developer ID requirement as fix(security): fail-closed CLI signature verification + https/browserstack.com redirect allowlist [DEVA11Y-473] #46, pinned to TeamYQ5FZQ855D. It runs on the extracted binary beforechmod/publish..sha256files are regenerated, soverify-selfupdate-checksumsstays green.CI. Both jobs are replaced with
tests/launcher-signature/run_tests.sh(runnable locally), onmacos-14:verify_binary_signatureverbatim from each launcher. It must accept the real CLI and refuse flipped-byte, ad-hoc-signed, unsigned and missing binaries; Linux must pass through and an unknown OS must be refused.Neither job is a required check (main requires
semgrep/ciandClaude Code Review), so the renames don't block merging.README: the sentence #46 adds ("launcher scripts do not yet verify…") now describes the launcher behaviour.
Testing (macOS arm64, real network)
run_tests.sh matrixrun_tests.sh publishedcode failed to satisfy specified code requirement(s)), so the Team pin does the workBrowserStack CLI signature verification failed; zip deleted; previously good binary untouched (same SHA-256)bash -non all launchers; self-update checksum filesThe end-to-end runs used a copy of the launcher pointed at a scratch cache directory.
🤖 Generated with Claude Code