[joshavant]

Problem and change

The selected pnpm12 release has an independent native TLS verifier that can accept the compromised eMudhra keys. Use native pnpm12.15.0 for package downloads through its independently fixed Rust TLS verifier. This combined candidate also retains the prepared fixed Node patch selections within the existing supported majors. Update the existing package-manager owner and regenerate its toolchain lock with the released package; the workspace dependency documents remain byte-identical.

Validation and remaining scope

pnpm check passes: 104 tests pass, 15 existing skips remain, and packed entrypoints plus ten target manifests are verified. The qualified native pnpm frozen install passes. Independent review is clean through P2; git diff --check passes. Official Linux arm64 pnpm12.15.0 rejects all36 incident trust cases, including explicit old CA inputs, and passes ordinary npm and private-CA controls. Platform-specific and hosted gates remain required.

Bun1.4.2, FreeBSD package contents, native cross-platform artifacts, and provider-owned action runtimes remain separate unresolved obligations.

The shared Node/pnpm composite also now defaults to nativepnpm12.15.0, covering all7CI/native/release callers. Its actual project working directory selected12.15.0 and frozen installation passed; completeowner/caller YAML checks and actionlint with the repository’s existing runner-label configuration passed. Fresh full-context P2review found no findings. Product source is unchanged; the earlier104-test fullcheck remains applicable.

Also upgrade the Alpine default CA bundle to 20261020-r0 before installing or running tools in every affected Node Alpine stage. The pinned base contains 20260909-r0, whose default bundle accepted six incident chains. The released replacement rejects all twelve tested chains; actual normal APK upgrade and package signatures/payloads were verified. Existing application checks are reused because application code is unchanged. This does not qualify custom CA overrides or publish rebuilt images.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR selects Node 22.23.4 and 24.22.1 and native pnpm 12.15.0 for development, CI, and release workflows.

Example: A package registry presents a certificate chain containing the compromised EMDVTLSCAG3B public key.

• Before: pnpm 12.10.1 uses rustls-webpki 0.103.15, before the upstream SPKI distrust fix.
• After: pnpm 12.15.0 includes rustls-webpki 0.103.16, which rejects paths containing that distrusted key.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The patch is focused and has no established introduced defect, but the security outcome is asserted without inspectable final-effect evidence.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Dependency downloads used for development and releases can trust certificate paths involving compromised CA keys.
Reason: The supplied maintainer-authored direction supports a focused security refresh without changing the public runtime API or expanding the incident remediation scope.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep this PR open: main still selects the affected toolchain, and the focused security update has clear value; no introduced code defect was established.

Priority: P1
Reviewed head: 2d9c7e38d412e72af5951e9ccb9f0481ddead949

Before merge

• Add real behavior proof - Authority-chain proof required: the PR reports native pnpm 12.15.0 rejecting 36 incident cases on Linux ARM64 and passing npm/private-CA controls, but the complete body and comments contain no terminal output or linked artifact showing the selected verifier rejecting a compromised-key peer before package content is accepted. Attach redacted traces identifying the artifact, trust configuration, successful controls, and rejection results for the changed paths; redact credentials, IPs, and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security concern: Establish rejection at the registry download boundary - Native pnpm selects platform trust by default and webpki for explicit custom roots; the reported Linux ARM64 result has no attached trace establishing which released artifact and trust paths rejected compromised peers before accepting package content.
• Resolve merge risk - The selected native pnpm artifacts use platform-dependent trust verification, so rejection of compromised-key registry peers across the changed download paths remains unestablished.

Findings

• [medium] Establish rejection at the registry download boundary — .github/actions/setup-node-pnpm/action.yml:9

Tests

• Missing end-to-end proof: Supply redacted Node/native-pnpm download traces for valid and compromised-key peers, including explicit old CA inputs and an existing checkout upgraded to the new toolchain; CI success does not exercise these rejection scenarios.

Agent review details

How this fits together

The shared setup action and workflow matrices select the runtimes and package manager that download dependencies, build native bindings, and prepare release packages.

flowchart LR
  A[CI and release workflows] --> B[Shared toolchain setup]
  B --> C[Selected Node and native pnpm]
  C --> D[Registry TLS verification]
  D --> E[Dependency downloads]
  E --> F[Native builds and release packages]

Loading

Technical review

Best possible solution:

Retain the focused version update through the existing toolchain owners and establish compromised-key rejection at the actual package-download boundary.

Do we have a high-confidence way to reproduce the issue?

Main selects pnpm 12.10.1, whose upstream lock predates the verified webpki distrust fix; this establishes the affected source path, but no incident handshake was reproduced during this read-only review.

Is this the best way to solve the issue?

Updating the existing package-manager selection and supported Node patch versions is the smallest appropriate repair, and the adjusted conditions preserve native test and artifact ownership.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 36eb601e55e5.

Merge-risk options

Maintainer options:

1. Verify the selected native download paths (recommended)
   Provide traces showing valid registry and private-CA downloads succeed while compromised-key peers are rejected before package content is accepted, identifying the native artifacts and trust modes exercised.

Provenance checked

• Shared pnpm selection and Node runtime matrices changes intended behavior with a stated reason (5852b3e: The original scaffold established Node 22/24 coverage, one shared package-manager setup, and ten native target lanes.)
• Artifact selection and installed-package release validation keeps the original intent (75a90ef: The installed-package gate verifies the actual published API before promotion; patch-version conditions retain the existing Node 24 artifact owner and validation paths.)
• Native runner and release dry-run boundaries keeps the original intent (36eb601: The preceding workflow change preserved native Intel proof, measured macOS deployment floors, and dry-run publication isolation; those decisions remain intact. A follow-history walk encountered an unavailable old blob, while scoped history and original creation blobs remained readable.)

Testing

Proof path: none.

Security

Needs attention: The update is supported by upstream security fixes, but final package-download rejection still needs observable evidence.

Evidence

Security concerns:

• [medium] Establish rejection at the registry download boundary — .github/actions/setup-node-pnpm/action.yml:9
  Native pnpm selects platform trust by default and webpki for explicit custom roots; the reported Linux ARM64 result has no attached trace establishing which released artifact and trust paths rejected compromised peers before accepting package content.
  Confidence: 0.94

What I checked:

• Exact introduced change: The pinned diff updates the existing setup owner, supported Node patch selections, conditional artifact uploads, FreeBSD major mappings, and pnpm toolchain lock entries; application dependency documents and production source remain unchanged. (.github/actions/setup-node-pnpm/action.yml:9, 2d9c7e38d412)
• Native verifier dependency: The patch executes this dependency for package downloads, making its TLS contract relevant: v12.10.1 locks rustls-webpki 0.103.15, while v12.15.0 locks 0.103.16; explicit custom CA settings select webpki verification. (Cargo.lock:7845, 91774e72a04d)
• Upstream distrust fix: The 0.103.16 release and 0.103.16: reject cert paths containing distrusted SPKIs rustls/webpki#546 identify the certificate-path SPKI distrust fix; the release tree includes the eight incident intermediate keys. (8ecdcc76f56b)
• Selected Node security releases: Both selected releases list the blocked-public-key TLS change from tls: reject chains containing blocked public keys nodejs/node#66871, supporting the Node version selections.
• Discussion and supplied validation: The complete PR body reports Linux ARM64 incident-case rejection and ordinary/private-CA success, but supplies no linked trace or artifact; both discussion comments contain review status only. (2d9c7e38d412)
• Existing platform contract preserved: The original workflow design in feat: add process identity and Darwin coalition capabilities #1 deliberately prepares dependencies on Linux and uses system Node inside FreeBSD; this PR retains that boundary and explicitly leaves FreeBSD package qualification outside its claims. (.github/workflows/native.yml:228, 5852b3e263bf)

Labels

Label changes:

• add P1: This addresses compromised certificate trust in dependency downloads used to build and release the package.
• add merge-risk: 🚨 security-boundary: The update changes the TLS verifier governing which registry peers can supply package content, with platform-dependent behavior still unproven.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P1: This addresses compromised certificate trust in dependency downloads used to build and release the package.
• merge-risk: 🚨 security-boundary: The update changes the TLS verifier governing which registry peers can supply package content, with platform-dependent behavior still unproven.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof that valid registry peers succeed and compromised-key peers fail before package content is accepted, covering explicit old CA inputs and identifying the selected native artifacts.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 6:38 PM ET / 22:38 UTC.