Verify integrity of downloaded Python engine packs#11
Open
phyceClaw wants to merge 1 commit into
Open
Conversation
Engine-pack bundles were downloaded (accepting plain http) and their bundled interpreter executed with no checksum/signature check, allowing MITM or a compromised asset to run arbitrary code. Require https and verify the SHA-256 digest (from the GitHub asset digest) before extracting/executing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Engine-pack bundles were downloaded (accepting plain
http://) and their bundled Python interpreter executed with no checksum or signature verification — a MITM or compromised release asset could run arbitrary code...) in manifest interpreter/entrypoint paths before they are joined and exec'd.Existing atomic
.part+rename and zip-slip protections are preserved.Digest source decision
The GitHub Releases API exposes a per-asset
digestfield (sha256:<hex>) on newer responses. The catalog now parses it into a newAvailablePack.ExpectedSHA256and threads it to the installer, which hashes the download while streaming to the.partfile and compares before the atomic rename.When no trusted digest is available (older API response, or a local pack), the install proceeds but logs a prominent
WARNthat the bundle is UNVERIFIED, rather than hard-failing — blocking all installs would break older release assets and local dev packs. Once release assets consistently carry digests this can be tightened to enforce-always.Testing
CGO_ENABLED=1 go build ./app/...passes.CGO_ENABLED=1 go test ./app/tts/engine/python/...passes, including new tests covering digest match/mismatch/abort, http rejection, digest parsing, and manifest path-traversal validation.🤖 Generated with Claude Code