Summary

Hardens CI security and adds adversarial/fuzz EVAL coverage for the updater's core security purpose: SHA256 checksum verification + SLSA attestation gating, fail-closed when gh is absent.

Net-new on top of the existing ci (test+coverage) and cascade workflows. No production behavior change beyond a defense-in-depth extraction cap and a toolchain bump; the fail-closed attestation contract already landed in #21 and is exercised by the evals here.

CI jobs added

security.yml

• race — go vet + go test -race ./... (security-scoped race gate, independent of coverage upload).
• gosec — Go SAST (securego/gosec@v2.27.1).
• govulncheck — known-vuln call-graph scan (golang/govulncheck-action@v1.0.4).
• gitleaks — secret scan over history/PR range (gitleaks/gitleaks-action@v3.0.0).
• dependency-review — PR-only, blocks high-severity vulnerable/incompatible deps (actions/dependency-review-action@v3).

codeql.yml

• CodeQL Go analysis, security-extended queries, push + PR + weekly schedule (github/codeql-action@v4).

Dependabot — .github/dependabot.yml already present (gomod weekly + github-actions weekly); requirement satisfied, unchanged.

All actions pinned to official released versions.

Scanner findings + resolutions

• govulncheck: 2 findings — GO-2026-5039 (net/textproto) and GO-2026-5037 (crypto/x509), both Go stdlib, fixed in go1.25.11. Resolved by bumping go.mod to go 1.25.11. Re-scan: clean.

• gosec: G110 (decompression bomb) — io.Copy of tar entries had no size cap. Fixed in code: per-entry io.LimitReader(tr, maxDownloadBytes+1) with an over-cap error in extractTarGz.

• gosec: accepted exclusions (documented inline in security.yml, minimal, never blanket):

  • G104 — best-effort os.Remove/Close on error-cleanup paths.
  • G204 — exec of gh/launchctl with internally-built args (no user input).
  • G301/G302 — install/staging dirs 0755; extracted artifacts are executables (must be 0755).
  • G304 — file paths derive from InstallDir/temp dir, inherent to an updater.
  • G404 — math/rand used only for thundering-herd jitter, not secrets.

  gosec exits 0 with these exclusions; never red, never blanket-disabled.

Evals added (adversarial / update integrity)

• FuzzVerifyChecksum — fuzzes the checksums.txt line parser with adversarial inputs (malformed lines, embedded NULs, giant fields, duplicate/garbage lines, no trailing newline). Asserts: never panics; only returns nil when a line genuinely parses to the correct SHA256 for the archive name (independent cross-check guards against verification bypass). 21k+ execs, no crashes.
• TestApplyUpdate_TamperedArchiveRefused — eval (e): valid checksums.txt for the original artifact, but the served archive bytes are swapped (MITM/CDN compromise). Asserts the update is refused and the on-disk daemon is left untouched.

Existing zz_*_test.go already cover the rest of the matrix and are confirmed green:

• (a) SHA256 mismatch refused — TestApplyUpdate_ChecksumMismatch
• (b) gh absent + SkipAttestation=false => fail closed — TestVerifyChecksumsAttestation_GhNotInstalled, TestVerifyChecksumsAttestation_FailsClosedWithoutSkip
• (c) SkipAttestation=true skips attestation but SHA256 stays mandatory — TestApplyUpdate_SkipAttestationStillRequiresChecksum, TestVerifyChecksumsAttestation_SkipConfig
• (d) happy path installs — TestApplyUpdate_PassesWithValidChecksums

Evals use the existing fakeable seams (verifyChecksumsAttestationFn, LookPath via PATH, httptest) — no real gh/network in CI.

Validation (GOWORK=off, go1.25.11)

go build ok · go vet ok · gofmt -l clean · go test -race ./... ok · FuzzVerifyChecksum 15s no crashes · govulncheck clean · gosec exit 0.