morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6480] Track supply-chain audit follow-up: runtime, dependency and release hardening #3886

New issue

Open

opened 2026-10-31 00:44:56 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-31 00:44:56 +00:00

Owner

Originally created by @gensokyo-dev on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6480

Decision needed

Track and complete the public maintenance work from a supply-chain audit: bring security baselines up to date, preserve release verification, and add proportionate ongoing checks. This is a maintenance tracker, not a claim that REA or a dependency has been compromised.

Context and evidence

Audit snapshot: main 7f9a03d6ab37a63ac1be768e3eae8545187f7d21, plus the actual npm rea-agents@6.7.0 distribution. Executed on Linux x64 with Node 24.18.0 / npm 11.16.0.

Observed:

The Node pin and accepted runtime floors predate the October 21, 2026 Node security releases. Existing work: #6283, #6315 and #6316.
npm audit --package-lock-only --ignore-scripts --json reports Vite 8.3.2, six advisories, highest severity high. This is a development dependency; production-only audits of both the source lock and the installed release reported zero known advisories. Existing fix: #6416. Upstream advisory.
A fresh installation of 6.7.0 resolved nine transitive package versions different from the lockfile at its attested release-source commit. Direct dependencies matched. This is allowed semver resolution, not evidence of malicious packages; the source lock alone does not pin consumers' full dependency trees.
All 758 source-lock dependency records have SHA-512 integrity and registry.npmjs.org resolution. All 180 external Action references are pinned to full commit SHAs. Source/consumer registry signature checks passed; the release tarball digest matched its registry integrity and attestation subjects.
131 relevant tests passed; five macOS-only cases were skipped on Linux. These checks do not constitute a complete malware analysis or a guarantee against unknown vulnerabilities.

Source-derived maintenance gaps:

No repository advisory/signature/dependency-review gate or dependency-update configuration was found in the audited workflow/configuration scope. A subsequent read-only GitHub API check on 2026-10-23 explicitly returned “Dependabot alerts are disabled for this repository.” Code scanning returned “no analysis found”; secret-scanning settings were not exposed. These API responses do not establish a vulnerability-free history.
The visible main rules require PR/CI checks but zero approving reviews; code-owner approval is not enforced.
SECURITY.md understates the implemented Linux Hopper verification: current code authenticates the package with a pinned PGP publisher key before extraction and verifies launcher SHA-256.

Expected interaction with targets

No new target interaction or reverse-engineering capability. Changes concern dependency/runtime maintenance, release/CI verification and security documentation. Checks may contact official registries and run isolated local fixtures. Existing setup approval and provider ownership boundaries must remain intact.

Boundary details

Keep vulnerability details, credentials and any sensitive proof private under SECURITY.md. Review publisher least privilege and credential isolation through the appropriate private channel; this public tracker deliberately contains no exploit details. npm publisher/2FA/token settings and private GitHub environment/runner settings were not accessible during the audit and must remain explicitly unknown until verified.

Options and tradeoffs

Reuse and validate existing fixes rather than create duplicate dependency PRs. Keep each implementation outcome focused, start from current main, preserve artifact lineage/digest/dist-tag validation and real consumer checks, and measure the added CI cost. Pinning a consumer tree also requires an update strategy; it must not freeze vulnerable dependencies indefinitely.

Verification available so far

Observed audit results and focused boundary tests, as described above. No full real-provider/OS matrix, source-to-native-binary reproducibility proof, or npm account-settings verification is claimed.

Success criteria and open questions

Validate and land the Node runtime-floor/pin updates, including remaining setup and environment instructions (#6283, #6315, #6316).
Validate and land the Vite security update (#6416).
Preserve release qualification and consumer verification while isolating npm publication (#6681); other credentialed release controllers remain separate hardening.
Add bounded, read-only advisory/signature checks with truthful failure and unavailable-evidence semantics.
Choose and validate a consumer dependency-tree reproducibility policy.
Align security documentation with actual installer verification.
Record administrator-owned review/environment/npm publishing controls and any unavailable settings.
Assess optional native-download and ancillary CI input pinning based on the actual trust and artifact boundaries.

References

#4898 (OpenSSF Scorecard proposal; broader than this focused maintenance work)
npm package-lock semantics
npm trusted publishing

Originally created by @gensokyo-dev on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6480 ## Decision needed Track and complete the public maintenance work from a supply-chain audit: bring security baselines up to date, preserve release verification, and add proportionate ongoing checks. This is a maintenance tracker, not a claim that REA or a dependency has been compromised. ## Context and evidence Audit snapshot: main `7f9a03d6ab37a63ac1be768e3eae8545187f7d21`, plus the actual npm `rea-agents@6.7.0` distribution. Executed on Linux x64 with Node 24.18.0 / npm 11.16.0. Observed: - The Node pin and accepted runtime floors predate the [October 21, 2026 Node security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Existing work: #6283, #6315 and #6316. - `npm audit --package-lock-only --ignore-scripts --json` reports Vite 8.3.2, six advisories, highest severity high. This is a development dependency; production-only audits of both the source lock and the installed release reported zero known advisories. Existing fix: #6416. [Upstream advisory](https://github.com/advisories/GHSA-587h-7wmj-h5pm). - A fresh installation of 6.7.0 resolved nine transitive package versions different from the lockfile at its attested release-source commit. Direct dependencies matched. This is allowed semver resolution, not evidence of malicious packages; the source lock alone does not pin consumers' full dependency trees. - All 758 source-lock dependency records have SHA-512 integrity and registry.npmjs.org resolution. All 180 external Action references are pinned to full commit SHAs. Source/consumer registry signature checks passed; the release tarball digest matched its registry integrity and attestation subjects. - 131 relevant tests passed; five macOS-only cases were skipped on Linux. These checks do not constitute a complete malware analysis or a guarantee against unknown vulnerabilities. Source-derived maintenance gaps: - No repository advisory/signature/dependency-review gate or dependency-update configuration was found in the audited workflow/configuration scope. A subsequent read-only GitHub API check on 2026-10-23 explicitly returned “Dependabot alerts are disabled for this repository.” Code scanning returned “no analysis found”; secret-scanning settings were not exposed. These API responses do not establish a vulnerability-free history. - The visible main rules require PR/CI checks but zero approving reviews; code-owner approval is not enforced. - `SECURITY.md` understates the implemented Linux Hopper verification: current code authenticates the package with a pinned PGP publisher key before extraction and verifies launcher SHA-256. ## Expected interaction with targets No new target interaction or reverse-engineering capability. Changes concern dependency/runtime maintenance, release/CI verification and security documentation. Checks may contact official registries and run isolated local fixtures. Existing setup approval and provider ownership boundaries must remain intact. ## Boundary details Keep vulnerability details, credentials and any sensitive proof private under `SECURITY.md`. Review publisher least privilege and credential isolation through the appropriate private channel; this public tracker deliberately contains no exploit details. npm publisher/2FA/token settings and private GitHub environment/runner settings were not accessible during the audit and must remain explicitly unknown until verified. ## Options and tradeoffs Reuse and validate existing fixes rather than create duplicate dependency PRs. Keep each implementation outcome focused, start from current main, preserve artifact lineage/digest/dist-tag validation and real consumer checks, and measure the added CI cost. Pinning a consumer tree also requires an update strategy; it must not freeze vulnerable dependencies indefinitely. ## Verification available so far Observed audit results and focused boundary tests, as described above. No full real-provider/OS matrix, source-to-native-binary reproducibility proof, or npm account-settings verification is claimed. ## Success criteria and open questions - [x] Validate and land the Node runtime-floor/pin updates, including remaining setup and environment instructions (#6283, #6315, #6316). - [x] Validate and land the Vite security update (#6416). - [x] Preserve release qualification and consumer verification while isolating npm publication (#6681); other credentialed release controllers remain separate hardening. - [ ] Add bounded, read-only advisory/signature checks with truthful failure and unavailable-evidence semantics. - [ ] Choose and validate a consumer dependency-tree reproducibility policy. - [ ] Align security documentation with actual installer verification. - [ ] Record administrator-owned review/environment/npm publishing controls and any unavailable settings. - [ ] Assess optional native-download and ancillary CI input pinning based on the actual trust and artifact boundaries. ## References - #4898 (OpenSSF Scorecard proposal; broader than this focused maintenance work) - [npm package-lock semantics](https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json/) - [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)

bsakaguchi added the

triage

enhancement

labels

2026-10-31 00:44:56 +00:00

bsakaguchi commented

2026-10-31 00:44:57 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 23, 2026):

Node core security floors are merged in #6315 (28a33cae8f8d4de8e11f7a266ff0d756432ab092). Current-head CI and automated review passed; all 19 touched files match the tested merge tree after landing. Local validation includes actual packed-package CLI/MCP install/update flows and the runtime-sensitive heap, callback-identity and HTTP client regressions.

The remaining environment-image and translated/get-started guidance changes in #6316 are next; the overall Node checklist item remains open until that follow-through lands.

@gensokyo-dev commented on GitHub (Oct 23, 2026): Node core security floors are merged in #6315 (`28a33cae8f8d4de8e11f7a266ff0d756432ab092`). [Current-head CI](https://github.com/morluto/rea/actions/runs/39913794790) and automated review passed; all 19 touched files match the tested merge tree after landing. Local validation includes actual packed-package CLI/MCP install/update flows and the runtime-sensitive heap, callback-identity and HTTP client regressions. The remaining environment-image and translated/get-started guidance changes in #6316 are next; the overall Node checklist item remains open until that follow-through lands.

bsakaguchi commented

2026-10-31 00:44:57 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 23, 2026):

CI prerequisite #6570 is merged as cc8835c7a316b7d82a9f6277ee1431e75d8305af. All four required checks passed; current-head CI completed with 14 successful jobs and 23 conditional skips. Final main’s six changed files match the actual CI merge. The fix retains process lifetime/identity, malformed-input, cancellation and cleanup coverage; it adopts main’s superseding firmware/Go producers.

Executed focused work included 219 integrated Go/P32/CLI/MCP/Inspector/ADB cases, a final 16-case ADB command-identity retest, and 76 cases on a network-disabled Ubuntu 26 container (one CPU, 2 GiB; 94.604 s, 90.134 CPU s, 1,109.8 MiB peak including page cache). Real Binwalk/Unblob/Hopper, Android devices and real Go compilers were not verified.

Resuming #6316 from new main, followed by the existing Vite update #6416 and the remaining supply-chain hardening. Signature checks cover installed platform-compatible trees; npm’s current JSON does not enumerate every successfully verified lockfile record, so cross-platform/full-lock signature coverage remains partial.

@gensokyo-dev commented on GitHub (Oct 23, 2026): CI prerequisite #6570 is merged as `cc8835c7a316b7d82a9f6277ee1431e75d8305af`. All four required checks passed; [current-head CI](https://github.com/morluto/rea/actions/runs/39939154729) completed with 14 successful jobs and 23 conditional skips. Final main’s six changed files match the actual CI merge. The fix retains process lifetime/identity, malformed-input, cancellation and cleanup coverage; it adopts main’s superseding firmware/Go producers. Executed focused work included 219 integrated Go/P32/CLI/MCP/Inspector/ADB cases, a final 16-case ADB command-identity retest, and 76 cases on a network-disabled Ubuntu 26 container (one CPU, 2 GiB; 94.604 s, 90.134 CPU s, 1,109.8 MiB peak including page cache). Real Binwalk/Unblob/Hopper, Android devices and real Go compilers were not verified. Resuming #6316 from new main, followed by the existing Vite update #6416 and the remaining supply-chain hardening. Signature checks cover installed platform-compatible trees; npm’s current JSON does not enumerate every successfully verified lockfile record, so cross-platform/full-lock signature coverage remains partial.

bsakaguchi commented

2026-10-31 00:44:58 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 23, 2026):

Node follow-through #6316 is merged as 520f8e8042c39833fb1656d3e55fb2896bff43a5, after #6315. All 51 changed files match the tested CI merge. Current-head checks passed eight built-test shards, five real Docker/agentenv cases, Linux package baseline, static/docs/website checks; local work passed 46 focused cases and the complete 25-case website suite. Source CI remains red only for three unchanged managed cases reproduced on clean main and tracked in #6650; the authorized existing PR-only merge exception was used, preserving the failed statuses and assertions.

These source changes are ready for a subsequent release. Continuing existing Vite security update #6416 from fresh main.

@gensokyo-dev commented on GitHub (Oct 23, 2026): Node follow-through #6316 is merged as `520f8e8042c39833fb1656d3e55fb2896bff43a5`, after #6315. All 51 changed files match the tested CI merge. Current-head checks passed eight built-test shards, five real Docker/agentenv cases, Linux package baseline, static/docs/website checks; local work passed 46 focused cases and the complete 25-case website suite. Source CI remains red only for three unchanged managed cases reproduced on clean main and tracked in #6650; the authorized existing PR-only merge exception was used, preserving the failed statuses and assertions. These source changes are ready for a subsequent release. Continuing existing Vite security update #6416 from fresh main.

bsakaguchi commented

2026-10-31 00:44:58 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 25, 2026):

Thanks for maintaining this tracker with concrete checkboxes. The npm publication isolation (#6681) and the Node runtime floor bumps (#6315/#6316) already landed, which covers two of the riskiest items. I'd prioritize the remaining advisory/signature gate and the consumer dependency-tree reproducibility policy next — those two give downstream users the most verifiable assurance per unit of work, and they pair naturally with the Scorecard proposal (#4898). Appreciate keeping the checks bounded/read-only with truthful failure states.

@XinwangTao commented on GitHub (Oct 25, 2026): Thanks for maintaining this tracker with concrete checkboxes. The npm publication isolation (#6681) and the Node runtime floor bumps (#6315/#6316) already landed, which covers two of the riskiest items. I'd prioritize the remaining advisory/signature gate and the consumer dependency-tree reproducibility policy next — those two give downstream users the most verifiable assurance per unit of work, and they pair naturally with the Scorecard proposal (#4898). Appreciate keeping the checks bounded/read-only with truthful failure states.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3886

No description provided.

Rows
Columns