Bootstrap: prevent rollback to older allowlisted releases
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Read scripts/bootstrap.sh, especially trusted_release_digest() and the v0.6.3 legacy requirements block. Trace how the latest release version and digest are checked, then decide how the allowlist should prevent older approved archives from being installed. Done means a rollback to an older allowlisted release is refused while the current reviewed release remains installable.
Written by the indexing model from the issue text.
Description
Summary
scripts/bootstrap.sh trusted_release_digest() keeps digests for older releases (currently v0.6.3 and v0.6.4). Anyone able to control the GitHub "latest release" API response could serve an older but still-allowlisted archive (rollback/downgrade), reintroducing issues fixed in later releases.
Proposal
- Once a newer release digest is reviewed and pinned, remove superseded digests from the allowlist (and the v0.6.3 legacy requirements block, as already noted in the code).
- Alternatively, keep a minimum-allowed version and refuse anything older.
Notes
Low severity: exploiting this requires a compromised GitHub API response, and only previously reviewed archives can be served.
- Dominant language
- Shell
- Stars
- 0
- Forks
- 0
- Avg merge
- 16m
- Merged PRs (30d)
- 40
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from graygarbage/HermesKey
-
future consideration packaging
Difficulty 1/5 1-3 hours Newbie friendliness 83/100
graygarbage/HermesKey#94 ·
Maintainers usually reply within 1 day
-
enhancement future consideration privacy
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
graygarbage/HermesKey#92 ·
Maintainers usually reply within 1 day
-
enhancement future consideration
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
graygarbage/HermesKey#89 ·
Maintainers usually reply within 1 day
-
enhancement experimental privacy
Difficulty 5/5 Over a week Newbie friendliness 35/100
graygarbage/HermesKey#96 ·
Maintainers usually reply within 1 day
-
documentation enhancement future consideration
Difficulty 4/5 3-5 days Newbie friendliness 45/100
graygarbage/HermesKey#95 ·
Maintainers usually reply within 1 day
All issues in graygarbage/HermesKey
Similar issues
-
bug github_actions security
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
DewaldOosthuizen/tech-cheat-sheets-and-notes#388 ·
Maintainers usually reply within 1 day
-
priority: low
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
melodic-software/claude-code-plugins#8831 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day