[GH-ISSUE #6337] [Feature] Add a verifiable manifest for exported analysis bundles #3822

New issue

Open

opened 2026-10-31 00:44:23 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:44:23 +00:00

Owner

Originally created by @jayykernel on GitHub (Oct 22, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6337

Problem

When analysis results and supporting evidence are exported or passed between tools, recipients need to know which files belong to the bundle and whether any files changed after export. Ad hoc directory contents make completeness and integrity difficult to verify.

Desired outcome

Provide an optional manifest for supported analysis bundles that records bundle contents and enough provenance to verify integrity.

Proposed behavior

List included files using normalized relative paths.
Record a cryptographic digest and byte size for each included file.
Include the relevant artifact identity and analysis metadata when available.
Provide a verification operation or documented procedure that detects missing, modified, and unexpected files.
Keep unavailable provenance fields explicit rather than guessing them.

Acceptance criteria

A generated bundle can be verified against its manifest.
Tests detect a modified file, missing file, and path traversal or invalid path entry.
Verification does not execute bundled artifacts.
The manifest format is versioned and documented.

Scope

Integrity verification establishes whether files match the manifest; it does not establish that the analysis is correct or that the manifest itself is trusted. Signing and remote attestation can remain out of scope.

Originally created by @jayykernel on GitHub (Oct 22, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6337 ### Problem When analysis results and supporting evidence are exported or passed between tools, recipients need to know which files belong to the bundle and whether any files changed after export. Ad hoc directory contents make completeness and integrity difficult to verify. ### Desired outcome Provide an optional manifest for supported analysis bundles that records bundle contents and enough provenance to verify integrity. ### Proposed behavior - List included files using normalized relative paths. - Record a cryptographic digest and byte size for each included file. - Include the relevant artifact identity and analysis metadata when available. - Provide a verification operation or documented procedure that detects missing, modified, and unexpected files. - Keep unavailable provenance fields explicit rather than guessing them. ### Acceptance criteria - A generated bundle can be verified against its manifest. - Tests detect a modified file, missing file, and path traversal or invalid path entry. - Verification does not execute bundled artifacts. - The manifest format is versioned and documented. ### Scope Integrity verification establishes whether files match the manifest; it does not establish that the analysis is correct or that the manifest itself is trusted. Signing and remote attestation can remain out of scope.

bsakaguchi referenced this issue

2026-10-31 01:10:29 +00:00

[PR #3822] [MERGED] fix(javascript): keep the request endpoint on a uniquely consumed response #5924

bsakaguchi referenced this issue

2026-10-31 01:14:08 +00:00

[PR #4759] [MERGED] fix(javascript): bind response endpoints only from writes that reach the read #6392