Problem: the publish-master cross-check compares npm pack bytes against the sidecar file recorded by the same runner that staged the binary; a self-asserted digest recorded at build time is the ground truth for the guard, so a broken stage (e.g. wrong binary copied) records a matching wrong sha and passes.
Suggested fix (advisory, defer): at publish-master start, re-fetch the platform tarball from the GitHub tag (gh release download), recompute its sha256, and verify it equals the sidecar; binds the sidecar to a fresh trigger source rather than runner self-assertion (the plan's deferred clean-runner audit).
Source: branch comment-checker-npm @ 23dedfd5abbbdfd35c8e883252b4055235b55654 (PR link backfilled after ship).
Metadata: Severity: P1 / Confidence: 75 / Reviewer(s): adversarial / Finding ID: release.yml-sha-sidecar-self-trust
Problem: the publish-master cross-check compares
npm packbytes against the sidecar file recorded by the same runner that staged the binary; a self-asserted digest recorded at build time is the ground truth for the guard, so a broken stage (e.g. wrong binary copied) records a matching wrong sha and passes.Suggested fix (advisory, defer): at publish-master start, re-fetch the platform tarball from the GitHub tag (
gh release download), recompute its sha256, and verify it equals the sidecar; binds the sidecar to a fresh trigger source rather than runner self-assertion (the plan's deferred clean-runner audit).Source: branch
comment-checker-npm@23dedfd5abbbdfd35c8e883252b4055235b55654(PR link backfilled after ship).Metadata: Severity: P1 / Confidence: 75 / Reviewer(s): adversarial / Finding ID: release.yml-sha-sidecar-self-trust