0 Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-12 17:59:08 +00:00

Files

T

Matt Van Horn ea87cf8984 fix(audit): bind unpacked ASAR member reads to their inventoried digests

A selected ASAR is captured and checked against its inventoried digest, which
binds packed members. An unpacked member is read from its .unpacked companion
on disk instead, and readContainerMember and readEntryBytes never compared
those bytes with the member digest inventory recorded, so a companion
replaced between inventory and the scan was accepted.

readContainerMember now passes the member's inventoried digest for unpacked
entries, and readStreamBounded hashes the full stream, draining past the read
allowance when needed, and fails with "ASAR member changed before
interpretation", which surfaces as an artifact_changed error like the
container check. A regression test replaces a companion after inventory. The
guide, spec, plan and tasks describe the binding.

2026-11-07 17:00:56 -08:00

2356-wasm-interface-comparison

feat(wasm): compare retained core-module interfaces (#2464 )

2026-10-13 23:49:04 +08:00

agent-environments

docs: organize canonical documentation layout and verify new pages (#2791 )

2026-11-08 01:42:28 +08:00

apk-signature

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

artifacts/release-exposure

fix(audit): bind unpacked ASAR member reads to their inventoried digests