wt
8bfaa06e64
Changes: Accept the bounded S00-027 connectivity record and add independent security review evidence and handoff. Validation: Fresh-cache control, candidate and pinned npm queries exited 0; fresh HTTPS artifact SHA512 SRI, size and SHA256 matched. make check exited 0 with 72 tests; executor patch/message, owner confirmation, scope and whitespace checked. No crypto/backend or distribution acceptance. Task: S00-027 Agent: auto-security-ccce71646176 Role: security Action: review Status: done Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation
5.6 KiB
S00-027: Approved npm registry connectivity record
- Status: accepted — independent security review S00-027; evidence:
state/evidence/S00-027-review.md. - Reviewer: auto-security-ccce71646176 (security), 2026-10-15.
- Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15.
- Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence.
- Output: connectivity evidence only for resuming the separate OMEMO2 investigation.
Environment-owner confirmation
Canonical state/tasks.json history revision 74 records coordinator-input-s00-027 releasing the external wait on 2026-10-15T09:45:53+00:00. The confirmation explicitly enables sandbox outbound network while retaining workspace-write restrictions, configured proxy and TLS. It reports successful prior probes and requires fresh executor and reviewer verification. This session reproduced access; it did not alter proxy, DNS, TLS, runner configuration or system tools. No credentials or private proxy values are recorded.
Actual commands and responses
All commands ran from project root. A fresh directory was created with Python tempfile.mkdtemp(prefix='luma-s00-027-'): /tmp/luma-s00-027-kdeu0fv9. Its cache was empty before the first query. Existing coordinator metadata, archive and cache were not used.
| Command | Exit | Actual response |
|---|---|---|
node --version |
0 | v24.1.0 |
npm --version |
0 | 11.3.0 |
npm config get strict-ssl |
0 | true |
npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache |
0 | "0.105.0" |
npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache |
0 | 3.0.0; GPL-3.0; integrity and URL below |
npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true |
0 | Same fields, fresh second cache |
No EAI_AGAIN or E404 occurred. npm emitted an update notice on the control query; no update was performed. Host runtime versions are explicitly recorded; these metadata/download-only probes do not build the application or replace ADR 0001 tool pins.
Pinned public artifact: libomemo.js 3.0.0 tarball. Primary metadata source: versioned registry record.
Registry integrity and independently computed SHA512 SRI both equal:
sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==
Artifact retrieval and integrity verification
An inline Python wrapper ran the pinned command above with subprocess.run(..., capture_output=True, text=True), required exit 0, parsed its JSON into meta, and asserted meta['version'] == '3.0.0'. The following retrieval/check body then ran unchanged inside that wrapper (root is the temporary directory above):
url=meta['dist.tarball'];assert url=='https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz'
with urllib.request.urlopen(url,context=ssl.create_default_context(),timeout=15) as response:
assert response.status==200 and response.url==url
data=response.read()
sri='sha512-'+base64.b64encode(hashlib.sha512(data).digest()).decode()
assert sri==meta['dist.integrity']
(root/'libomemo.js-3.0.0.tgz').write_bytes(data)
Imports were subprocess,json,pathlib,urllib.request,ssl,hashlib,base64. The wrapper also wrote public verification JSON under the temporary root. Actual wrapper exit: 0. HTTP status: 200; final URL unchanged; archive size: 1,061,939 bytes. SHA256: be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8. Archive saved only under /tmp; it was neither extracted nor installed nor executed. Python used its default validated SSL context and existing configured environment; no certificate/proxy-policy bypass was used.
Acceptance boundary and review handoff
Both required live metadata queries and the pinned artifact/SRI verification succeeded in the fresh agent session. This proposes acceptance of network restoration only. Registry integrity matches bytes to registry metadata; it does not establish independent provenance, safety or crypto suitability. GPL-3.0 is reported metadata, not a distribution approval.
No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged.
The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits.
Independent acceptance
Security reviewer auto-security-ccce71646176 reproduced both live metadata queries with a new empty temporary cache and the pinned metadata/download/SHA512 check under normal TLS. Responses, 1,061,939-byte archive and SHA256 matched the executor record. No package scripts were executed. make check passed 72 tooling tests. This accepts registry connectivity only; all crypto/backend and distribution limits above remain. Coordinator owns the review commit.