wt
8bfaa06e64
Changes: Accept the bounded S00-027 connectivity record and add independent security review evidence and handoff. Validation: Fresh-cache control, candidate and pinned npm queries exited 0; fresh HTTPS artifact SHA512 SRI, size and SHA256 matched. make check exited 0 with 72 tests; executor patch/message, owner confirmation, scope and whitespace checked. No crypto/backend or distribution acceptance. Task: S00-027 Agent: auto-security-ccce71646176 Role: security Action: review Status: done Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation
4.6 KiB
S00-027 independent security review
Reviewer: auto-security-ccce71646176 (security). Executor: auto-ci-cd-40ae46e8efe7 (ci-cd). Date: 2026-10-15. Decision: APPROVE connectivity record only.
Input: assigned card/packet, required startup/workflow/TESTING/crypto/ADR index reads, both blocker reports, exact ENC-003/009/011, accepted ADR 0000/0001 and all direct dependency evidence/reviews/handoffs. Output: accepted connectivity metadata and this independent report. Focused acceptance: actual control/candidate registry responses, pinned HTTPS download with matching SRI, no policy bypass or crypto/backend acceptance.
Patch and boundaries
Read implementation commit 0b60f3d84e and external-input checkpoint 927728daf1. Executor message accurately describes the document, live probes, checks and limits. The implementation changes only the allowed connectivity document plus workflow/generated artifacts. Initial working tree was clean. Revision 74 of canonical history confirms approved sandbox outbound access while retaining configured proxy, TLS and filesystem restrictions; supplied prior caches/archives were not reused.
No credentials, private proxy details or real conversations appear in the task artifacts. Metadata was treated as data; pinned URL was asserted to the official HTTPS tarball before retrieval and final URL remained identical. TLS verification stayed enabled (npm strict-ssl=true, Python default SSL context). No install, extraction, package execution, custom crypto, system/network/Git configuration change, plaintext fallback, immutable spec or shared contract edit occurred. Host Node/npm were used solely for metadata connectivity, with accepted build pins unchanged.
Independent commands and actual results
python3 scripts/tasks.py resume --agent auto-security-ccce71646176,show S00-027,packet S00-027 --agent auto-security-ccce71646176: exit 0 each. Reviewer did not claim; owner differs and direct prerequisites are done.- Read-only git log/show/status and canonical history inspection: exit 0; patch and executor message agree.
node --version: exit 0.npm --version: exit 0.npm config get strict-ssl: exit 0.npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/cache --strict-ssl=true: exit 0.npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/cache --strict-ssl=true: exit 0.npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true: exit 0.
Python tempfile/subprocess/urllib/ssl/hashlib/base64 wrapper: exit 0. Fresh root /tmp/luma-s00-027-review-4ngu6s8g; cache absent before first query, separate pinned-cache also new. Control returned 0.105.0; candidate and pinned candidate returned 3.0.0, GPL-3.0 and the documented official tarball/SRI. No EAI_AGAIN or E404. Wrapper asserted metadata version and exact public HTTPS URL, required HTTP 200 and unchanged final URL, downloaded using ssl.create_default_context(), computed SHA512 SRI and asserted equality with registry metadata. Archive and public verification.json were saved only under the fresh temporary root; no package code ran.
- Archive size: 1,061,939 bytes.
- SHA512 SRI:
sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==. - SHA256:
be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8.
These results match the executor record exactly.
make check > /tmp/luma-s00-027-review-check.log 2>&1: exit 0, 72 tests in 18.796s, OK. Foundation integrity only.git diff --check: exit 0 before report; final authored metadata/diff inspected for whitespace and scope before approval.
Acceptance and limits
All three card acceptance conditions pass independently. Registry SRI proves agreement between retrieved bytes and registry metadata, not independent provenance, vulnerability clearance, license distribution approval or crypto suitability. Browser/WASM/worker execution, OMEMO2/SCE mapping, interoperability, audited engine/persistence compatibility and application readiness were not checked or accepted. Existing crypto ADR and experiments remain unchanged. Approval permits only S00-022 to return to the queue for a fresh executor through CLI workflow. Coordinator must commit this review transition; reviewer ends after approve.