Fail closed on release lookup and verify reproducible bootstrap inputs
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
Start with scripts/bootstrap.sh and trace how download_url() selects release assets, handles API errors, and invokes extraction and installation. Review the dependency declarations and existing bootstrap tests, then add mocked coverage for API failure and integrity mismatch; done means both paths abort before installer, systemctl, or extracted code runs, and release inputs and required network access are documented.
Written by the indexing model from the issue text.
Description
Release-channel trust hardening
scripts/bootstrap.sh defaults to a published release, but download_url() silently falls back to a mutable main branch archive if the latest-release API request fails. The installer then extracts and executes the archive without an independent digest/signature check; it also upgrades pip/wheel and resolves broad dependency ranges (faster-whisper>=1.0.0, av>=11,<19) at install time. TLS and the GitHub/PyPI infrastructure still provide transport trust; this is not evidence of a current compromise. The concern is unexpected code/version drift in a tool that handles private dictation.
Acceptance
- Default release mode fails closed and gives a clear retry message on API/asset errors; fetching
mainrequires explicit--main(or an equally conspicuous confirmation). Test the failure path with a mocked API and assert installer/systemctl are not run. - Define a release-asset integrity strategy (version-pinned digest/signature with an independent trusted reference) and test a mismatch aborts before running extracted code. Do not claim a checksum from the same untrusted response alone solves source compromise.
- Make Python dependencies reproducible per release (reviewed pins/constraints and preferably hashes or a vetted lock) while retaining explicit upgrade paths for security fixes; document what network access bootstrap requires. No automatic tracking or telemetry.
- Dominant language
- Shell
- Stars
- 0
- Forks
- 0
- Avg merge
- 16m
- Merged PRs (30d)
- 40
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from graygarbage/HermesKey
-
enhancement ux
Difficulty 4/5 3-5 days Newbie friendliness 25/100
graygarbage/HermesKey#16 ·
Maintainers usually reply within 1 day
-
enhancement packaging
Difficulty 3/5 Half a day Newbie friendliness 40/100
graygarbage/HermesKey#15 · 2 comments ·
Maintainers usually reply within 1 day
-
enhancement packaging
Difficulty 4/5 3-5 days Newbie friendliness 32/100
graygarbage/HermesKey#14 ·
Maintainers usually reply within 1 day
-
enhancement packaging
Difficulty 3/5 1-2 days Newbie friendliness 50/100
graygarbage/HermesKey#13 · 1 comment ·
Maintainers usually reply within 1 day
-
enhancement gui lexicon
Difficulty 4/5 3-5 days Newbie friendliness 30/100
graygarbage/HermesKey#12 ·
Maintainers usually reply within 1 day
All issues in graygarbage/HermesKey
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
Maintainers usually reply within 2 days
-
Bug triage/confirmed
Difficulty 2/5 Half a day Newbie friendliness 85/100
agentscope-ai/agentscope#3355 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
bioconda/bioconda-recipes#70401 ·
Maintainers usually reply within 2 days
-
Bisect issue233186Openbisect
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
dtcxzyw/llvm-bisect-service#548 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
btcpayserver/btcpayserver-doc#1654 ·
Maintainers usually reply within 1 day