fix(obolup): fail closed on release-checksum verification failure#776
Merged
Merged
Conversation
verify_release_checksum() returned 0 (treated as verified) whenever the SHA256SUMS fetch failed, no checksum entry matched the binary, or no local sha256 tool was available — letting a tampered/corrupted obol binary install silently in all three cases since download_release() only aborts on a non-zero return. Fail closed instead: a missing checksum entry or missing hashing tool now returns 1 and aborts the install via the existing download_release() error path. A failed SHA256SUMS fetch also fails closed by default, gated behind an explicit OBOL_ALLOW_UNVERIFIED=1 opt-in for channels that legitimately don't publish sums. Confirmed Canary402 full-surface audit finding. Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Full-surface audit finding: self-update checksum fails open
Found by the 2026-07-16 whole-product-surface audit (PR #770), adversarially confirmed.
obolup.sh'sverify_release_checksum()— the only integrity check guarding the downloadedobolbinary —return 0(treated as verified) in three failure branches: SHA256SUMS unfetchable, no matching checksum entry, or nosha256sum/shasumon the host. A tampered binary installs whenever the attacker also suppresses/omits the checksum.Fix
These now fail closed — a missing checksum entry or absent hashing tool aborts the install. The unfetchable-SHA256SUMS case defaults to abort, with an explicit
OBOL_ALLOW_UNVERIFIED=1opt-in for channels that legitimately don't publish sums.bash -nclean.Note (separate, still open — see PR #770 triage): the other tools
obolup.shfetches (kubectl/helm/k3d/helmfile/k9s, Ollama's installer) are still downloaded with no checksum at all — a broader hardening this PR does not cover.https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk