security: wire verifyEnvelope into the consume side + constant-time compare + reject unkeyed-when-key-set

Open
#873 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
30/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
typescript
Domain
security

Research direction

Start in verdict.ts around verifyEnvelope (~196) and inspect the tests that currently call it, then trace the consume-side gate-decision and replay-audit paths. Confirm the design with maintainers before changing behavior; done means consumers verify HMACs with constant-time comparison and reject unkeyed sha256 signatures when a signing key is configured.

Written by the indexing model from the issue text.

Description

Found during v0.8.1 release review (Chaos Gremlin / security auditor). Pre-existing, not regressed by v0.8.1.

verifyEnvelope (verdict.ts:~196) is only called in tests — no consumer (gate decision / replay audit) actually verifies the HMAC before trusting a verdict envelope, so signing is currently produce-only (proves who-produced, not who-can-reject). Also: (1) it uses plain === string compare on the HMAC instead of crypto.timingSafeEqual; (2) when ALTIMATE_REVIEW_SIGNING_KEY is unset it falls back to an unkeyed sha256: digest that still 'verifies' — an envelope can be silently re-forged if the key is absent.

Fix: wire verifyEnvelope into the consuming/gate path; use timingSafeEqual over equal-length buffers; reject when the stored signature is the unkeyed sha256: form while a key is configured. Deferred because it needs its own design + review (signing-soundness change), not a patch-release rush.

Dominant language
TypeScript
Stars
813
Forks
134
Avg merge
2d 5h
Merged PRs (30d)
62

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from AltimateAI/altimate-code

All issues in AltimateAI/altimate-code

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.