fix(security): harden self-update with tagged refs + SHA-256 verification [DEVA11Y-478] - #27
Open
sunny-se wants to merge 1 commit into
Open
fix(security): harden self-update with tagged refs + SHA-256 verification [DEVA11Y-478]#27sunny-se wants to merge 1 commit into
sunny-se wants to merge 1 commit into
Conversation
…tion (DEVA11Y-478) Self-update previously fetched executable code from refs/heads/main with only a shebang check (CWE-494, CVSS 7.8). Now: 1. Version pointer (latest-version.txt) fetched from main — metadata only 2. Actual script fetched from immutable tagged ref (refs/tags/vX.Y.Z) 3. SHA-256 checksum verified against SHA256SUMS before overwriting Migration: old scripts on dev machines will self-update from main one last time, pulling the new mechanism. All subsequent updates go through the verified tagged path. Post-merge: tag the merge commit as v1.0.0 and push tag immediately. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
refs/tags/vX.Y.Z) instead of mutablerefs/heads/mainHow it works
SCRIPT_VERSION="v1.0.0"scripts/latest-version.txtfrommain(metadata only, not executable)SHA256SUMSfrom the immutable tagged refSHA256SUMSMigration (backwards compat)
Old scripts on dev machines still have the old self-update pointing at
refs/heads/main. When this merges, they'll self-update from main one last time (final insecure fetch), pulling the new secure mechanism. All subsequent updates go through the verified tagged path.Post-merge action required
Immediately after merge, create and push the
v1.0.0tag:Files changed
scripts/{bash,zsh,fish}/{spm,cli}.sh(6 files)SCRIPT_VERSION, replacescript_self_update()scripts/latest-version.txtscripts/SHA256SUMSTest plan
grep -r "refs/heads/main" scripts/ --include="*.sh"— no mutable refs in download URLsSCRIPT_VERSIONpresent in all 6 scriptsshasum -a 256verification in all 6 scriptscd scripts && shasum -a 256 -c SHA256SUMS— all 6 OKJira
DEVA11Y-478
🤖 Generated with Claude Code