#502 Security hardening: sign releases and publish provenance, not only SHA256SUMS

[Anonymous]

Originally created by: athanclark

Release artifacts have no signatures or provenance; trust rests on the GitHub release alone

• Severity: Low. No exploit is needed against users, but compromising the GitHub account, a maintainer token or the contents: write release job is enough to swap the packages and SHA256SUMS together, and downstream channels re-derive their checksums from those assets.
• Affected: every release asset (.deb, .rpm, FreeBSD .pkg, Windows .exe, desktop .deb/.rpm/AppImage/.dmg/.exe, the offline HTML), the Homebrew tap and the AUR packages.
• Location:
• scripts/release-assets.mjs:4 and 38-46 write SHA256SUMS.txt only.
• release.yml:91-106 uploads with --clobber.
• release.yml:129-133 and 177-185: the Homebrew formula and AUR PKGBUILDs take their sha256 from the asset just downloaded from the same release (scripts/aur-packages.mjs:63-67, 99). The AUR pgmp checksum is computed from a fresh download at release time (aur-packages.mjs:63), not pinned as deploy/windows-server/pgmp.sha256 is.
• README.md:308: "Windows installers and macOS applications are currently unsigned (macOS is not notarized)".
• Description: There is no GPG or minisign signature, no Sigstore or actions/attest-build-provenance, and no signed apt/dnf repository, so users install .deb/.rpm files by hand with no signature check. The desktop app has no updater (no tauri-plugin-updater; src-tauri/tauri.conf.json has no updater or pubkey), so there is no updater key to steal but also no authenticated update channel. The checksums only detect transport corruption.
• Attack scenario:
• Precondition: someone with release write access, or a malicious maintainer token.
• Steps: re-upload trojaned assets with --clobber and a matching SHA256SUMS, then re-run the release so the Homebrew and AUR jobs publish the new hashes.
• Impact: code execution as root through postinst on every server that upgrades.
• What defends against it today: actions are SHA-pinned, the publish job alone has contents: write, and secrets reach only tag and release runs. Checksums detect mirror corruption.
• Suggested fix: Add actions/attest-build-provenance (needs id-token: write, attestations: write) for each asset, and sign SHA256SUMS with a key kept outside GitHub, or with Sigstore cosign keyless signing. Pin the pgmp tarball sha256 in the repo for AUR, as Windows and Nix already do. Authenticode-sign the Windows installers and notarize the macOS apps once certificates exist (already noted in the README). Consider tag protection rules for v*.
• Confidence: confirmed.

---

From the security review of 2026-11-06 (commit 6776c44), finding L-16: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed