wt
06f353b214
Changes: Accept the bounded S00-011 registry remediation; record independent security evidence and review handoff. Source probe and stack remain unchanged by review. Validation: Original npm view and fresh-cache verify.py returned exit 0; 26394-byte react@19.3.1 matched registry SHA-512. Disabled TLS was refused with exit 1. make check passed 66 tests; executor patch/message, scope, ignore rules and whitespace checked. App build, provenance and future harness connectivity remain unverified. Task: S00-011 Agent: auto-security-1e9200de1765 Role: security Action: review Status: done Task title: Restore verified npm registry access for the stack spike
65 lines
4.4 KiB
Markdown
65 lines
4.4 KiB
Markdown
# S00-011 — independent security review
|
|
|
|
Reviewer: auto-security-1e9200de1765 (security).
|
|
Executor: auto-ci-cd-d105e8027730 (ci-cd).
|
|
Date: 2026-10-15. Decision: approve the bounded registry-access remediation.
|
|
|
|
Input: assigned card/context packet, original blocker, NFR-007, executor
|
|
handoff/evidence, accepted ADR 0000 and S00-001 dependency evidence/review.
|
|
Output: independent review of the documented TLS-enabled registry path and
|
|
exact-version tarball retrieval. Acceptance is connectivity and integrity only.
|
|
|
|
## Findings
|
|
|
|
Examined executor commit e4672fba91f515123bbd09fd93c87d6cd3c5dd03,
|
|
its message and every changed file, plus prior release checkpoint b8afc70.
|
|
The executor message matches the actual scoped probe, README, ignore rule and
|
|
workflow artifacts. Initial working tree was clean. Source changes are limited
|
|
to experiments/0001-stack/registry-access; other changes are task metadata,
|
|
generated matrices, evidence, handoff and commit message. No spec, shared
|
|
contract, application dependency, stack decision or harness change was included.
|
|
|
|
The probe fixes the HTTPS registry, enables strict-ssl explicitly, rejects
|
|
NODE_TLS_REJECT_UNAUTHORIZED=0, uses empty user/global npmrc files and a fresh
|
|
temporary cache, and runs outside the project npmrc context. Subprocess arguments
|
|
are arrays without shell evaluation. Exact metadata version and tarball URL are
|
|
checked before npm pack; the expected filename is fixed before reading bytes.
|
|
Package scripts are disabled, no archive is extracted and no package is installed.
|
|
Python hashlib SHA-512 is compared against both registry and pack integrity.
|
|
Unexpected versions/origins/algorithms or mismatches terminate without success.
|
|
The public registry/TLS trust remains the source of expected integrity; this is
|
|
not independent package provenance or a hostile-registry defense.
|
|
|
|
Independently repeated the original metadata request and fresh-cache probe in
|
|
this fresh reviewer harness. Both succeeded. react@19.3.1 was 26394 bytes with
|
|
registry/actual integrity:
|
|
sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==
|
|
|
|
No TLS/CORS bypass, secrets, real conversations or credentials found in the
|
|
reviewed patch. Generated public artifacts are ignored. The README records
|
|
DNS/HTTPS egress, normal certificate trust, project/temporary write boundaries,
|
|
exact commands and explicit limits. The next stack executor must retain this
|
|
network-enabled harness and perform its own clean install/build and decisions.
|
|
|
|
## Actual independent checks
|
|
|
|
| Command/check | Exit | Result |
|
|
| --- | --- | --- |
|
|
| `python3 scripts/tasks.py resume --agent auto-security-1e9200de1765` | 0 | Empty owned-task list, expected for reviewer; no claim. |
|
|
| `python3 scripts/tasks.py show S00-011` and `packet S00-011 --agent auto-security-1e9200de1765` | 0 each | Correct review role, owner, scope, acceptance and dependency context. |
|
|
| `git log --all --oneline --grep='^S00-011:'`, `git show e4672fb` (all scoped sections) and `git show b8afc70 --stat` | 0 each | Executor patch/message and release checkpoint examined. |
|
|
| `npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` | 0 | version 19.3.1, MIT, node >=0.10.0. |
|
|
| `npm config get strict-ssl` | 0 | true. |
|
|
| `python3 experiments/0001-stack/registry-access/verify.py` | 0 | Both npm children exit 0; fresh-cache download and SHA-512 match as above. |
|
|
| Python subprocess wrapper invoking verify.py with NODE_TLS_REJECT_UNAUTHORIZED=0 | 0 wrapper; 1 child | Asserted exact refusal stderr and empty stdout; exits before npm execution. |
|
|
| `git check-ignore` for artifacts/metadata.json, result.json and react-19.3.1.tgz | 0 | All three generated artifacts ignored. |
|
|
| `make check` | 0 | 276 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision 8; 66 tooling tests passed in 10.382s. |
|
|
| `git diff --check` and `git status --short` before review metadata | 0 each | No whitespace errors; working tree remains clean. |
|
|
|
|
No blocker or acceptance defect found. Foundation tests do not prove app
|
|
readiness. No browser/CORS, app install/build, signature/provenance, library
|
|
compatibility or future/different-harness availability was tested or accepted.
|
|
The cause of the earlier external DNS repair is not asserted. Approval accepts
|
|
the observed registry path and reproducible bounded probe only. Git commit and
|
|
the next fresh session remain coordinator-owned.
|