Bind pack signature verification to actual content (closes #9) - #16
Merged
Conversation
…ity) verify_pack_signature signed/verified name@version:manifest.checksum but never recomputed content_checksum(pack.items), so an attacker could swap pack.items for a malicious payload, leave manifest.checksum untouched, and the signature still verified — 'volo pack verify' would print VALID on a tampered pack. Verification now recomputes content_checksum(pack.items) and rejects when it no longer matches manifest.checksum, re-binding the signature to real content. The registry-install path already had an independent content_checksum guard; this closes the standalone verify primitive. 3 regression tests. Closes #9.
🛫 Volo reliability — ❌ NO-SHIPReplayed 7 adversarial scenarios against the agent (threshold ≥ 0.90).
Cost — replayed deterministically at $0 (no live API calls). baseline |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #9. Security fix.
verify_pack_signaturesigned/verifiedname@version:manifest.checksumbut never recomputedcontent_checksum(pack.items). An attacker could swappack.itemsfor a malicious payload, leavemanifest.checksumuntouched, and the signature still verified — sovolo pack verify(the standalone 'should I trust this file?' gate) printedVALIDon a tampered pack.Fix
Verification now recomputes
content_checksum(pack.items)and rejects when it no longer matchesmanifest.checksum, re-binding the signature to the real items. The registry-install path already had an independent content-checksum guard (registry.py), so this closes the exposed standalone-verify surface.Tests
3 regression tests: untampered verifies; content tamper (checksum field untouched) → False; manifest-checksum forgery → False. Full suite 531 passed, mypy + ruff clean.