wt
8bfaa06e64
Changes: Accept the bounded S00-027 connectivity record and add independent security review evidence and handoff. Validation: Fresh-cache control, candidate and pinned npm queries exited 0; fresh HTTPS artifact SHA512 SRI, size and SHA256 matched. make check exited 0 with 72 tests; executor patch/message, owner confirmation, scope and whitespace checked. No crypto/backend or distribution acceptance. Task: S00-027 Agent: auto-security-ccce71646176 Role: security Action: review Status: done Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation
63 lines
5.6 KiB
Markdown
63 lines
5.6 KiB
Markdown
# S00-027: Approved npm registry connectivity record
|
|
|
|
- Status: accepted — independent security review S00-027; evidence: `state/evidence/S00-027-review.md`.
|
|
- Reviewer: auto-security-ccce71646176 (security), 2026-10-15.
|
|
- Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15.
|
|
- Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence.
|
|
- Output: connectivity evidence only for resuming the separate OMEMO2 investigation.
|
|
|
|
## Environment-owner confirmation
|
|
|
|
Canonical `state/tasks.json` history revision 74 records coordinator-input-s00-027 releasing the external wait on 2026-10-15T09:45:53+00:00. The confirmation explicitly enables sandbox outbound network while retaining workspace-write restrictions, configured proxy and TLS. It reports successful prior probes and requires fresh executor and reviewer verification. This session reproduced access; it did not alter proxy, DNS, TLS, runner configuration or system tools. No credentials or private proxy values are recorded.
|
|
|
|
## Actual commands and responses
|
|
|
|
All commands ran from project root. A fresh directory was created with Python `tempfile.mkdtemp(prefix='luma-s00-027-')`: `/tmp/luma-s00-027-kdeu0fv9`. Its cache was empty before the first query. Existing coordinator metadata, archive and cache were not used.
|
|
|
|
| Command | Exit | Actual response |
|
|
| --- | --- | --- |
|
|
| `node --version` | 0 | v24.1.0 |
|
|
| `npm --version` | 0 | 11.3.0 |
|
|
| `npm config get strict-ssl` | 0 | true |
|
|
| `npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | `"0.105.0"` |
|
|
| `npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | 3.0.0; GPL-3.0; integrity and URL below |
|
|
| `npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true` | 0 | Same fields, fresh second cache |
|
|
|
|
No EAI_AGAIN or E404 occurred. npm emitted an update notice on the control query; no update was performed. Host runtime versions are explicitly recorded; these metadata/download-only probes do not build the application or replace ADR 0001 tool pins.
|
|
|
|
Pinned public artifact: [libomemo.js 3.0.0 tarball](https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz). Primary metadata source: [versioned registry record](https://registry.npmjs.org/libomemo.js/3.0.0).
|
|
|
|
Registry integrity and independently computed SHA512 SRI both equal:
|
|
|
|
```text
|
|
sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==
|
|
```
|
|
|
|
## Artifact retrieval and integrity verification
|
|
|
|
An inline Python wrapper ran the pinned command above with `subprocess.run(..., capture_output=True, text=True)`, required exit 0, parsed its JSON into `meta`, and asserted `meta['version'] == '3.0.0'`. The following retrieval/check body then ran unchanged inside that wrapper (root is the temporary directory above):
|
|
|
|
```python
|
|
url=meta['dist.tarball'];assert url=='https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz'
|
|
with urllib.request.urlopen(url,context=ssl.create_default_context(),timeout=15) as response:
|
|
assert response.status==200 and response.url==url
|
|
data=response.read()
|
|
sri='sha512-'+base64.b64encode(hashlib.sha512(data).digest()).decode()
|
|
assert sri==meta['dist.integrity']
|
|
(root/'libomemo.js-3.0.0.tgz').write_bytes(data)
|
|
```
|
|
|
|
Imports were `subprocess,json,pathlib,urllib.request,ssl,hashlib,base64`. The wrapper also wrote public verification JSON under the temporary root. Actual wrapper exit: 0. HTTP status: 200; final URL unchanged; archive size: 1,061,939 bytes. SHA256: `be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8`. Archive saved only under `/tmp`; it was neither extracted nor installed nor executed. Python used its default validated SSL context and existing configured environment; no certificate/proxy-policy bypass was used.
|
|
|
|
## Acceptance boundary and review handoff
|
|
|
|
Both required live metadata queries and the pinned artifact/SRI verification succeeded in the fresh agent session. This proposes acceptance of network restoration only. Registry integrity matches bytes to registry metadata; it does not establish independent provenance, safety or crypto suitability. GPL-3.0 is reported metadata, not a distribution approval.
|
|
|
|
No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged.
|
|
|
|
The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits.
|
|
|
|
## Independent acceptance
|
|
|
|
Security reviewer auto-security-ccce71646176 reproduced both live metadata queries with a new empty temporary cache and the pinned metadata/download/SHA512 check under normal TLS. Responses, 1,061,939-byte archive and SHA256 matched the executor record. No package scripts were executed. `make check` passed 72 tooling tests. This accepts registry connectivity only; all crypto/backend and distribution limits above remain. Coordinator owns the review commit.
|