#511 Document how to verify release checksums, and sign them

[Anonymous]

Originally created by: athanclark

Release checksums are unsigned, undocumented and carry no provenance

• Severity: Informational (hardening).
• Location:
• scripts/release-assets.mjs:36-46 writes SHA256SUMS.txt beside the assets.
• .github/workflows/release.yml:92-101 uploads it to the same GitHub release, with --clobber.
• Description:
• SHA256SUMS.txt lives in the same place as the files it covers. Anyone who can replace an asset can replace the sums too, and it is not signed.
• There is no Sigstore or GitHub build-provenance attestation (actions/attest-build-provenance).
• No user-facing doc tells people how to verify the offline file (grep SHA256SUMS docs README.md finds nothing).
• Copies hosted by third parties (the point of a single HTML file) therefore have no verifiable link back to a release.
• The build itself is careful: actions are pinned to SHAs, the tag and commit identity are checked, and Build: <tag> is embedded in the HTML.
• Suggested fix:
• Add actions/attest-build-provenance for the HTML files, or sign SHA256SUMS.txt with cosign/minisign.
• Document sha256sum -c and gh attestation verify in the download docs.
• Optionally show the file's own hash in the About dialog.
• Confidence: Confirmed (absence of signing, provenance and docs).

---

From the security review of 2026-11-06 (commit 6776c44), finding I-10: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed