Skip to content

fix(security): use atomic temp-dir swap for cache updates [DEVA11Y-482] - #21

Open
sunny-se wants to merge 1 commit into
mainfrom
fix/DEVA11Y-482-atomic-cache-update
Open

fix(security): use atomic temp-dir swap for cache updates [DEVA11Y-482]#21
sunny-se wants to merge 1 commit into
mainfrom
fix/DEVA11Y-482-atomic-cache-update

Conversation

@sunny-se

@sunny-se sunny-se commented May 26, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • F-013 / DEVA11Y-482 — prepareArtifact() had a TOCTOU race (CWE-362): the check-delete-create-download sequence left a large window where parallel builds could corrupt each other's cache state.
  • Downloads and extracts into a UUID-named temp directory under the cache root, then atomically moves it to the version directory after extraction succeeds.
  • On failure, defer cleans up the temp directory automatically.

Verification

  • Build the SPM plugin on macOS (swift build)
  • Build the SPM plugin on Windows (CI)
  • Confirm cached CLI binary is correctly placed and executable after download
  • Confirm re-run with existing cache hits the early-return path (no re-download)
  • Confirm forceDownload flag triggers fresh download into temp dir and atomic swap

References

  • Jira: DEVA11Y-482
  • CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization

🤖 Generated with Claude Code
@sunny-se @claude
fix(security): use atomic temp-dir swap in prepareArtifact
f00a0a3 
F-013 / DEVA11Y-482 — prepareArtifact had a TOCTOU race (CWE-362)
where the check-delete-create-download sequence left a large window
for parallel builds to corrupt state. Download into a temp directory
and atomically move to the version directory after completion.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@sunny-se
sunny-se requested a review from a team as a code owner May 26, 2026 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@sunny-se