docs(G02): add macOS live-validation readiness packet - #59
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4c38283a26
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ```sh | ||
| cd experiments/g02-auth | ||
| GOTOOLCHAIN=go1.26.8 go build -trimpath -o "$G02_PRIVATE_PARENT/g02-enroll-$G02_HARNESS_SHA" ./cmd/g02-enroll |
There was a problem hiding this comment.
When either G02 build is run from a dirty checkout or a revision other than the approved SHA, go build still succeeds; here $G02_HARNESS_SHA merely becomes part of the filename, and g02-enroll never validates its embedded revision or dirty status. The subsequent commands can therefore create or verify an App and consume a PEM using unreviewed code despite the packet's immutable-artifact gate. Build from a clean checkout of the approved SHA and verify the embedded VCS metadata and binary digest before execution.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2136830cda
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if ! [[ -d "$G02_PRIVATE_PARENT" && ! -L "$G02_PRIVATE_PARENT" ]]; then | ||
| die 'artifact parent must be an existing private directory' |
There was a problem hiding this comment.
Fresh evidence in the new preflight is that G02_PRIVATE_PARENT is accepted solely for being an existing non-symlink directory, despite being described as private. If it is group/world-writable, another account with directory write access can rename the verified 0500 binary and replace g02-enroll before the later manual invocation, causing unreviewed code to receive the PEM. Require current-UID ownership and private permissions, and recheck the opened artifact immediately before each live execution.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| local dump="$G02_PRIVATE_PARENT/.$(basename "$binary").codesign" | ||
| local actual_signing="$G02_PRIVATE_PARENT/.$(basename "$binary").signing-facts" | ||
| codesign -d --verbose=4 "$binary" >"$dump" 2>&1 \ | ||
| || die "could not inspect signing identity: $binary" | ||
| signing_facts "$dump" >"$actual_signing" | ||
| cmp -s "$actual_signing" "$expected_signing" \ | ||
| || die "signing identity mismatch: $binary" |
There was a problem hiding this comment.
Fresh evidence in this revision is that the added identity check can compare its output to itself: if G02_ENROLL_SIGNING_RECORD is set to $G02_PRIVATE_PARENT/.g02-enroll.signing-facts (or the probe equivalent), this redirect overwrites the independently approved record and cmp necessarily succeeds. Reject path/inode aliases with the generated files or load the expected record before writing outputs so a different valid signing identity cannot bypass the independent approval gate.
AGENTS.md reference: AGENTS.md:L6-L6
Useful? React with 👍 / 👎.
| actual_digest="$(shasum -a 256 "$binary" | awk 'NF == 2 { count++; digest = $1 } END { if (count != 1) exit 1; print digest }')" \ | ||
| || die "could not hash $binary" |
There was a problem hiding this comment.
When G02_PRIVATE_PARENT contains whitespace—a common macOS case such as an Application Support directory—shasum prints the filename as additional whitespace-separated fields, so NF == 2 never holds and the awk command exits nonzero. This makes the mandatory provenance gate unusable for an otherwise valid private directory; parse and validate the digest independently of the filename fields.
Useful? React with 👍 / 👎.
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e25c2f1cd9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (( (8#$mode & 0022) != 0 && (8#$mode & 01000) == 0 )); then | ||
| die "artifact parent chain permits cross-UID rename: $path" |
There was a problem hiding this comment.
When G02_PRIVATE_PARENT is beneath a mode-1777 directory owned by another non-root UID, this condition treats the sticky bit as sufficient. Sticky semantics still allow that directory's owner to rename any child, so after check_artifact returns the owner can replace the checked 0700 artifact tree before run_verified opens the binary; a live manual invocation can then execute an unreviewed replacement with the PEM on stdin. This is fresh evidence beyond the prior writable-parent finding: the newly added sticky exception parses owner but never constrains it. Accept writable sticky ancestors only when owned by root or the current UID, or execute an already-open verified descriptor.
AGENTS.md reference: AGENTS.md:L6-L6
Useful? React with 👍 / 👎.
| [[ ! -e "$G02_ENROLL_BINARY" && ! -L "$G02_ENROLL_BINARY" && ! -e "$G02_PROBE_BINARY" && ! -L "$G02_PROBE_BINARY" ]] \ | ||
| || die 'artifact path already exists; use a fresh private path' | ||
|
|
||
| cd "$G02_SOURCE_DIR/experiments/g02-auth" |
There was a problem hiding this comment.
When the operator follows the instruction to keep the Bash process that passed this gate alive, this cd permanently leaves it in $G02_SOURCE_DIR/experiments/g02-auth. The later documented cd experiments/g02-auth and cd experiments/g01-scaleset commands therefore resolve beneath that module and exit with No such file or directory, preventing the offline checks and G01 plan from running in the prescribed sequence. Run these builds in a subshell or restore the prior directory before the gate returns.
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 060766efdb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (( (8#$mode & 0022) != 0 )); then | ||
| if (( (8#$mode & 01000) == 0 )) || \ | ||
| [[ "$owner" != 0 && "$owner" != "$G02_CURRENT_UID" ]]; then | ||
| die "artifact parent chain permits cross-UID rename: $path" |
There was a problem hiding this comment.
Fresh evidence beyond the prior sticky-owner case is that a foreign-owned ancestor with mode 0755 passes this check because only group/other write bits are examined. For a path such as /tmp/foreign/private, the owner of foreign can rename that component after check_artifact succeeds and replace the pathname before run_verified executes it, allowing an unverified binary to receive the PEM. Require every replaceable non-root ancestor to be owned by root/current UID, or execute an already-open verified descriptor.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| cd experiments/g02-auth | ||
| GOTOOLCHAIN=go1.26.8 go test -race -count=1 -timeout=45s ./... | ||
| GOTOOLCHAIN=go1.26.8 go vet ./... | ||
| GOTOOLCHAIN=go1.26.8 go run ./cmd/g02-synthetic |
There was a problem hiding this comment.
Fresh evidence after hardening the artifact builds is that these commands still execute tests and g02-synthetic from the caller's unchecked checkout rather than $G02_SOURCE_DIR. If that checkout is dirty or at another revision, go test and go run execute unreviewed code on the native Mac even though the provenance gate approved a different detached source tree; run this block from the validated clone and recheck its revision/cleanliness before execution.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| Offline G02 checks, with no GitHub access: | ||
|
|
||
| ```sh | ||
| cd experiments/g02-auth |
There was a problem hiding this comment.
Fresh evidence after the earlier working-directory fix is this separate cd, which still runs in the kept Bash process. After the offline checks finish, the later cd experiments/g01-scaleset resolves beneath experiments/g02-auth and fails, preventing the documented G01 plan step; run this block in a subshell or restore the original directory.
Useful? React with 👍 / 👎.
| CGO_ENABLED=1 GOTOOLCHAIN=go1.26.8 go build -buildvcs=true -trimpath -tags=g01_live -o "$G01_PRIVATE_BINARY" ./cmd/g01-live | ||
| "$G01_PRIVATE_BINARY" --plan |
There was a problem hiding this comment.
When the caller checkout is dirty or at a different revision, -buildvcs=true only embeds metadata; this block never compares it with the required G01_HARNESS_SHA and immediately executes the resulting binary. Consequently the purportedly safe plan can run unreviewed code on the native Mac and produce evidence for the wrong controller revision. Build from the approved detached SHA and verify clean VCS metadata and the artifact before execution.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| env -u GOFLAGS GOENV=off GOTOOLCHAIN=go1.26.8 GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 \ | ||
| go build -buildvcs=true -trimpath -o "$G02_ENROLL_BINARY" ./cmd/g02-enroll | ||
| env -u GOFLAGS GOENV=off GOTOOLCHAIN=go1.26.8 GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 \ | ||
| go build -buildvcs=true -trimpath -tags=g02runtime -o "$G02_PROBE_BINARY" ./cmd/g02-keychain-probe |
There was a problem hiding this comment.
When the inherited PATH contains a directory writable by another UID, the trust-producing commands in this gate—including git, env, go, stat, shasum, and codesign—can resolve to attacker-controlled executables. A substituted build tool executes before artifact validation, and substituted hash/signature tools can then approve its output, defeating the reviewed-artifact boundary. Resolve verified root-owned utilities by absolute path or establish and validate a trusted PATH before running any gate command.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| manifest --live-github \ | ||
| --owner "$APP_OWNER_ALIAS" --app-name "$DISPOSABLE_APP_ALIAS" \ | ||
| --org "$ORG_A_ALIAS:$ORG_A_ID" --org "$ORG_B_ALIAS:$ORG_B_ID" \ | ||
| --journal-dir "$G02_PRIVATE_PARENT/g02-attempt-$OWNER_NONCE" |
There was a problem hiding this comment.
When an approved nonce contains slashes and enough .. components, the constructed journal path can normalize outside $G02_PRIVATE_PARENT; the shell validates no nonce syntax, and openJournal checks the created journal directory but not the ownership or mode of its immediate parent. A user who controls that escaped parent can rename the retained journal between invocations, allowing a later Manifest run to appear fresh despite an unresolved App attempt. Require a nonempty single-component nonce with a strict character/length pattern and verify the final journal path remains a direct child of the private parent.
AGENTS.md reference: AGENTS.md:L6-L6
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 974999b5b0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if ! [[ -d "$G02_SOURCE_DIR/.git" && ! -L "$G02_SOURCE_DIR/.git" ]]; then | ||
| die 'source must be a standalone clone with a real .git directory' |
There was a problem hiding this comment.
When $G02_SOURCE_DIR or one of its ancestors is foreign-owned or reached through a replaceable symlink, this check accepts it because ownership and parent-chain validation are applied only to artifact_root. That owner can replace the checkout after the SHA/cleanliness checks but before the cgo builds, making the trusted Mac process unreviewed source and potentially access arbitrary dependencies even though the eventual digest mismatch rejects the artifact. Reject unsafe source components, retain the canonical path, and recheck it immediately before both builds.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
|
Exact-head review checkpoint at 974999b: Public CI succeeded, but Codex P1 #59 (comment) is independently reproduced. Foreign-owned source can pass clean/detached/SHA checks before build; artifact-only protection is insufficient. Merge remains blocked. Independent Luna/max validated the artifact-ancestor fix and retained guards, but this is not approval of the source path. Under the current explicit user override, Grok 4.6/xhigh is assigned sole implementation ownership of the readiness shell gate correction and a complete audit of all current/stale findings; Luna retains PR62 runtime ownership in a separate worktree. New head must pass fresh independent review, exact-head Codex and CI. No live operations authorized or performed. |
Reject foreign-owned source directories and ancestors before git identity, builds, and offline go test/vet/run. Retain the canonical source path and recheck the detached clean SHA immediately before those uses. Pin Darwin system tools to absolute paths, constrain OWNER_NONCE to one path component, keep offline/G01 commands in subshells on the validated clone, and verify the G01 plan against G01_HARNESS_SHA.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7ce1665111
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| GOTOOLCHAIN=go1.26.8 "$G02_GO" test -race -count=1 -timeout=45s ./... | ||
| GOTOOLCHAIN=go1.26.8 "$G02_GO" vet ./... | ||
| GOTOOLCHAIN=go1.26.8 "$G02_GO" run ./cmd/g02-synthetic |
There was a problem hiding this comment.
Fresh evidence beyond the earlier checkout finding is that these commands still inherit GOFLAGS: when the caller has GOFLAGS=-overlay=... or GOFLAGS=-toolexec=..., recheck_source remains clean while go test and go run compile substituted files or execute an external tool on the native Mac. go help environment confirms that GOFLAGS supplies default flags to Go commands, and go help build documents both -overlay and -toolexec; invoke these checks through the pinned env with GOFLAGS removed and other build configuration explicitly bounded.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| "$G02_ENV" -u GOFLAGS GOENV=off GOTOOLCHAIN=go1.26.8 CGO_ENABLED=1 \ | ||
| "$G02_GO" build -buildvcs=true -trimpath -tags=g01_live -o "$G01_PRIVATE_BINARY" ./cmd/g01-live |
There was a problem hiding this comment.
When inherited GOWORK names a workspace containing this validated module plus a replace for github.com/actions/scaleset, this build can compile an unreviewed local dependency while retaining the expected main-module vcs.revision and vcs.modified=false; check_buildinfo does not inspect dependency replacements, and the resulting binary is immediately executed. go help environment confirms that GOWORK selects a workspace, while go help work states that workspace replacements take precedence, so set GOWORK=off and bound the remaining compiler/build environment before producing the plan binary.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| "$G02_AWK" -F= '$1 == "Identifier" || $1 == "Authority" || $1 == "Signature" || $1 == "TeamIdentifier" { print }' \ | ||
| | LC_ALL=C sort |
There was a problem hiding this comment.
Fresh evidence after the earlier trusted-tools finding is that signing normalization still invokes bare sort, so when inherited PATH resolves it from a foreign-writable directory, attacker-controlled code runs inside the provenance gate. A stateful replacement can pass through and retain the two approved records, then emit those retained facts instead of the later observed codesign output, making the signing comparison succeed; assign and validate an absolute system sort alongside the other pinned tools.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
Run every build/test/vet/run/plan through g02_go with an empty environment and pinned CC/PATH/GOTOOLCHAIN/GOENV/GOWORK. Resolve Homebrew go to a physical path, walk tool ancestors, pin sort, and check signing-record parents. Preserve source/artifact 0700 policy and cgo Darwin builds.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e0a90e2832
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [[ "$("$G02_GIT" -C "$G02_SOURCE_DIR" rev-parse --verify HEAD^{commit})" != "$G02_SOURCE_SHA" ]]; then | ||
| die 'source HEAD does not equal the approved full SHA' | ||
| fi | ||
| if [[ -n "$("$G02_GIT" -C "$G02_SOURCE_DIR" status --porcelain=v1 --untracked-files=all --ignored)" ]]; then |
There was a problem hiding this comment.
When the caller has GIT_DIR and GIT_WORK_TREE set to a separate clean checkout at the approved SHA, these direct Git queries inspect that checkout despite -C, while the later offline block compiles $G02_SOURCE_DIR; I reproduced this with a modified second checkout and status returned empty. The git(1) ENVIRONMENT section documents these variables as overriding the repository and working-tree locations, so go test or go run can execute dirty, unreviewed source on the native Mac. Run every identity query through a clean, explicitly bounded Git environment.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| if (( (8#$mode & 8#20) != 0 )) && [[ "$owner" != "$G02_CURRENT_UID" ]]; then | ||
| die "${kind} chain is group-writable by another owner: $path" |
There was a problem hiding this comment.
When the physical Homebrew Go installation has a current-UID-owned group-writable ancestor shared with another local account, this condition permits that account's rename access. The account can replace the tool after the initial pin—or race the repeated pathname check—and g02_go then executes the replacement before any artifact digest or signature verification. Reject every cross-UID-writable tool ancestor, including current-owner group-writable directories without protective sticky semantics, or stage the approved tool under a private tree.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| git clone --no-local "$G02_REPOSITORY_URL" "$G02_SOURCE_DIR" | ||
| git -C "$G02_SOURCE_DIR" checkout --detach "$G02_SOURCE_SHA" |
There was a problem hiding this comment.
Fresh residual evidence after the earlier trusted-PATH finding is that checkout creation still invokes bare git before the gate pins /usr/bin/git. When the inherited PATH begins with a foreign-writable directory, an attacker-controlled git executes on the native Mac during clone; subsequent source and artifact checks cannot undo that execution. Use an already validated absolute Git executable, or establish and validate the trusted tool environment before these commands.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| check_safe_parent_chain "$artifact_root" | ||
| parent_stat="$("$G02_STAT" -f '%u %A' "$artifact_root")" || die 'could not recheck artifact parent' | ||
| read -r parent_uid parent_mode <<<"$parent_stat" | ||
| [[ "$parent_uid" == "$G02_CURRENT_UID" && "$parent_mode" == 700 ]] \ | ||
| || die 'artifact parent changed from current-UID mode 0700' |
There was a problem hiding this comment.
When the private artifact parent has POSIX mode 0700 but a macOS ACL grants another UID add_file and delete_child, these %A mode checks still accept it; macOS chmod(1) documents those as separate directory ACL permissions. That UID can replace the checked binary between check_artifact and the pathname execution in run_verified, allowing unreviewed code to receive the PEM. Inspect and reject write/delete ACL grants on every protected path component, or execute a verified open descriptor instead.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| : "${HOME:?HOME must be set for the pinned Go toolchain}" | ||
| "$G02_ENV" -i \ | ||
| PATH="$G02_TOOL_PATH" \ | ||
| HOME="$HOME" \ | ||
| TMPDIR=/tmp \ |
There was a problem hiding this comment.
When HOME points to a foreign-owned or cross-UID-writable directory, the otherwise empty environment still places Go's default GOPATH and GOCACHE there, and toolchain switching may also load go1.26.8 from that state. Go's environment documentation defines these as the workspace/module-cache and build-cache locations, so another UID can replace trusted cache entries or a downloaded toolchain before go test, go run, or the G01 plan build; those paths execute output without the G02 artifact-digest gate. Validate the home/cache ownership chain or set GOPATH, GOMODCACHE, and GOCACHE to fresh 0700 directories under $G02_PRIVATE_PARENT.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
Move clone/checkout after pinned g02_git with a clean Git environment so GIT_DIR cannot hide ignored source. Put HOME/GOCACHE/GOMODCACHE/GOPATH under the private 0700 tree with GOTOOLCHAIN=local. Refuse group-write tool ancestors and writable macOS ACLs; bound symlink hops.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e41f7bbfb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| GOTOOLCHAIN=local \ | ||
| GOENV=off \ | ||
| GOWORK=off \ | ||
| GOPROXY=off \ |
There was a problem hiding this comment.
With the prescribed newly created G02_GOMODCACHE, this setting prevents the later G01 plan build from resolving the dependencies declared in experiments/g01-scaleset/go.mod; there is no vendor tree or cache-population step anywhere in the repository. I reproduced the documented build shape with an empty cache and it stopped with module lookup disabled by GOPROXY=off, consistent with the Go module reference, so a first-time operator never reaches --plan. Populate the private cache from independently reviewed module artifacts (or vendor them) before disabling proxy access rather than fetching unreviewed code during the native-Mac run.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| --owner "$APP_OWNER_ALIAS" --app-name "$DISPOSABLE_APP_ALIAS" --app-id "$APP_ID" \ | ||
| --org "$ORG_A_ALIAS:$ORG_A_ID:$INSTALL_A_ID" \ | ||
| --org "$ORG_B_ALIAS:$ORG_B_ID:$INSTALL_B_ID" \ | ||
| --journal-dir "$G02_JOURNAL_DIR" < "$G02_PRIVATE_PEM" |
There was a problem hiding this comment.
When the owner-supplied PEM is mode 0600 but has a macOS ACL granting another UID read access, this command accepts it as protected input: privateInput in experiments/g02-auth/cmd/g02-enroll/main.go:46-58 checks only UID, POSIX permission bits, file type, and link count, while this preflight never checks the PEM or its containing path. This can expose the App credential even though the live procedure treats the descriptor as private. Validate the opened descriptor's ACL or require it to originate under an ACL-checked private directory before allowing manual verification.
Useful? React with 👍 / 👎.
| [[ "$G02_GOROOT" == "$G02_PRIVATE_PARENT/"* && -f "$G02_GOROOT/bin/go" && ! -L "$G02_GOROOT/bin/go" ]] \ | ||
| || die 'GOROOT must be a staged distribution under the private parent' | ||
| g02_go_ver="$(g02_go version)" || die 'could not read staged go version' | ||
| [[ "$g02_go_ver" == *'go1.26.8'* ]] || die 'staged toolchain is not Go 1.26.8' |
There was a problem hiding this comment.
When an Intel Go 1.26.8 archive is staged on this Apple Silicon host and Rosetta is available, its output (go version go1.26.8 darwin/amd64) satisfies this substring test even though the packet requires the reviewed darwin/arm64 distribution; the same test would also accept a later version such as go1.26.80. The go version command reports both the toolchain version and target platform, so parse and require the exact version token and darwin/arm64 fields before using the compiler.
Useful? React with 👍 / 👎.
| G02_BASENAME=/usr/bin/basename | ||
| G02_LS=/bin/ls | ||
| G02_MKDIR=/bin/mkdir | ||
| G02_CURRENT_UID="$("$G02_ID" -u)" || die 'could not determine the current UID' |
There was a problem hiding this comment.
When the operator launches this packet through sudo or an existing root shell, G02_CURRENT_UID becomes 0 and every subsequent current-owner check accepts root-owned source, caches, signing records, and artifacts. The enrollment binary has no root refusal, so the documented live Manifest/manual commands can then run as root despite gate 5 explicitly declaring that a root controller is not authorized; this also records evidence under the wrong Keychain/launchd identity and leaves root-owned private state. Fail immediately when the captured UID is zero, before cloning, building, or invoking any live command.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e41f7bbfb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| g02_go_ver="$(g02_go version)" || die 'could not read staged go version' | ||
| [[ "$g02_go_ver" == *'go1.26.8'* ]] || die 'staged toolchain is not Go 1.26.8' |
There was a problem hiding this comment.
Fresh residual evidence after the tool-ancestry hardening is that ownership, mode, location, and a self-reported version are the only checks on the staged toolchain. If G02_GO is a tampered or otherwise unapproved executable, it can print a matching go1.26.8 version while arbitrary code has already run on the native Mac; the later G02 artifact digests cannot undo that execution, and the offline go test/go run and G01 plan outputs have no independent artifact digest. Bind an approved digest/signature to the complete staged distribution and verify it before the first g02_go invocation.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| local binary="$1" expected_digest="$2" expected_signing="$3" | ||
| shift 3 | ||
| check_artifact "$binary" "$expected_digest" "$expected_signing" | ||
| "$binary" "$@" |
There was a problem hiding this comment.
Fresh evidence beyond the earlier inherited-GOFLAGS finding is that only g02_go gets an empty environment: run_verified launches the artifact with every caller variable intact, and the direct G01 invocation does likewise. When the kept Bash process contains DYLD_INSERT_LIBRARIES and these newly built ad-hoc/unhardened Mach-O binaries are launched, dyld can load an unreviewed library before main; in manual enrollment that library inherits the PEM-bearing stdin descriptor. Execute both verified binaries through a minimal explicit environment that excludes loader-injection variables.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| GOTOOLCHAIN=local \ | ||
| GOENV=off \ | ||
| GOWORK=off \ | ||
| GOPROXY=off \ |
There was a problem hiding this comment.
The new private-cache fix creates G02_GOMODCACHE empty, while this setting disables every module lookup. Following the documented sequence, I reproduced Go reporting module lookup disabled by GOPROXY=off; the G01 module imports the dependencies declared in experiments/g01-scaleset/go.mod:7-16 and has no vendor tree, so the plan build at line 754 cannot succeed without an undocumented cache-population step. Stage and verify the required modules in this private cache before going offline, or provide a reviewed vendored dependency tree.
AGENTS.md reference: AGENTS.md:L11-L11
Useful? React with 👍 / 👎.
| G02_GOCACHE="$G02_HOME/gocache" | ||
| G02_GOMODCACHE="$G02_HOME/gomodcache" | ||
| G02_GOPATH="$G02_HOME/gopath" | ||
| install_private_dir "$G02_HOME" "private Go HOME" |
There was a problem hiding this comment.
When the kept Bash process is lost after a Manifest attempt has created an App or retained journal, rerunning this mandatory gate against the same private parent fails because install_private_dir rejects the already-created $G02_HOME (and the later artifact checks likewise reject existing binaries). Using a fresh private parent makes require_owner_nonce point at a different journal, so the documented manual fallback cannot reopen the unresolved attempt without undocumented deletion and variable overrides. Add a restart path that revalidates existing private state and explicitly binds the retained journal before allowing same-App recovery.
AGENTS.md reference: AGENTS.md:L6-L6
Useful? React with 👍 / 👎.
Reject UID 0 before ownership checks, hash the published Go 1.26.8 archive before any go execution, reuse validated private dirs without resetting journals, run G02/G01 binaries with a minimal environment, and bootstrap G01 modules in a private stage so the offline plan does not rewrite the approved clone.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6d304935f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| [[ -f "$G02_GO_ARCHIVE" && ! -L "$G02_GO_ARCHIVE" ]] \ | ||
| || die 'Go archive must be a regular non-symlink file' | ||
| archive_digest="$("$G02_SHASUM" -a 256 < "$G02_GO_ARCHIVE" | "$G02_AWK" 'NF >= 1 { count++; digest = $1 } END { if (count != 1) exit 1; print digest }')" \ |
There was a problem hiding this comment.
When the caller exports PERL5OPT and PERL5LIB, /usr/bin/shasum—a Perl script—loads the nominated module before calculating a digest; I reproduced a module executing and emitting an attacker-chosen 64-hex value that this awk pipeline accepted. Because both the Go archive and later binaries are hashed through this inherited environment, arbitrary code can run on the native Mac and forge every digest gate before the reviewed artifacts execute. Invoke shasum through a minimal environment that clears Perl startup variables, as required by Perl's environment documentation.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| "$G02_TAR" -C "$G02_TOOLCHAIN" -xzf "$G02_GO_ARCHIVE" \ | ||
| || die 'could not extract the official Go archive' |
There was a problem hiding this comment.
When G02_GO_ARCHIVE is foreign-owned or writable by another UID, the gate accepts it because it checks only that it is a regular non-symlink file. That UID can rewrite it after the digest at line 566 and before this separate pathname open by tar, causing an unapproved toolchain to be extracted and invoked; its replacement go can print the expected version and pass the remaining location checks. Validate the archive's owner, mode, link count, ACL, and ancestry, then stage the verified bytes under the private tree before extraction.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| if [[ -n "$(g02_git --git-dir "$G02_SOURCE_DIR/.git" --work-tree "$G02_SOURCE_DIR" \ | ||
| status --porcelain=v1 --untracked-files=all --ignored)" ]]; then | ||
| die 'source has tracked, untracked, or ignored changes' |
There was a problem hiding this comment.
When the restart path reuses an existing clone containing a tracked file owned by another UID, this cleanliness check still succeeds because Git does not report file ownership; I reproduced a clean status after changing a tracked file's UID. If the source directories are traversable, that owner can rewrite the file after recheck_source returns and before the build or offline Go command opens it, so unreviewed code runs despite the approved commit and safe directory ancestry. Require safe ownership, permissions, ACLs, and file type for build inputs, or materialize a fresh protected snapshot instead of trusting an existing worktree.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
| GIT_CONFIG_NOSYSTEM=1 \ | ||
| GIT_CONFIG_GLOBAL=/dev/null \ | ||
| GIT_CONFIG_SYSTEM=/dev/null \ | ||
| "$G02_GIT" "$@" |
There was a problem hiding this comment.
When the restart path reuses a clone whose .git/config and .git/info/attributes define a clean filter, these settings still load that repository-local configuration because they disable only system and global configuration. I reproduced git status executing such a filter command, so unreviewed code can run on the native Mac during recheck_source before cleanliness or artifact validation can refuse anything; validate an allowlisted local configuration and reject command-bearing attributes, or recreate the clone from an empty protected destination. Git documents that a filter attribute invokes configured clean and smudge commands.
AGENTS.md reference: AGENTS.md:L10-L10
Useful? React with 👍 / 👎.
|
Independent Luna/max review of exact head No live App/credential/Keychain/launchd/runner operation occurred. Under accepted release sequencing #66, broad #2 qualification remains preserved in R3 and its single-organization foreground credential subset is now #67. These findings must not be inherited into that MVP path; no merge or live authorization is implied by relabeling. Further corrective writing awaits conflict-free orchestration assignment; the completed review worker is released. |
1 participant
Ref #2 (bounded documentation continuation; does not close the issue).
Summary
Safety and scope
Validation
git diff --cached --checkpassed before commit.Integration update