Fix: Harden pinned runtime activation

2026-08-27 08:32:44 -04:00
parent 8264ca6320
commit 31fc1d3eaa
5 changed files with 501 additions and 95 deletions
@@ -64,6 +64,14 @@ Artifact digests were checked with `sha256sum ARTIFACT` against the lowercase
 64-hex values in `installers.conf`; all runtime downloads also enforce the
 recorded byte limit before atomic replacement.

+The `*_BINARY_SHA256` values are the SHA-256 digests of the exact executable
+bytes selected from each verified runtime archive. They were derived without
+executing the artifacts: `tar -xO` selected Node's `bin/node` and Codex's
+`bin/codex`, while `unzip -p` selected Bun's `bun`. Runtime version directories
+record both the reviewed archive digest and this reviewed installed-byte digest
+in `.panama-provenance`; later runs require the receipt and re-hash the installed
+binary before treating an existing directory as trusted.
+
 ## Rotation policy

 Do not replace a key on an automated update. A key rotation is a reviewed
@@ -1,23 +1,29 @@
 BUN_VERSION=1.4.0
 BUN_X86_64_URL=https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip
 BUN_X86_64_SHA256=2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452
+BUN_X86_64_BINARY_SHA256=33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b
 BUN_X86_64_MAX_BYTES=67108864
 BUN_AARCH64_URL=https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip
 BUN_AARCH64_SHA256=4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e
+BUN_AARCH64_BINARY_SHA256=086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9
 BUN_AARCH64_MAX_BYTES=67108864
 NODE_VERSION=24.20.0
 NODE_X86_64_URL=https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz
 NODE_X86_64_SHA256=2f2c0da162318f0de47665410c7c8c2ed3d36c8f3105de4bbc61176c70a7cbf2
+NODE_X86_64_BINARY_SHA256=89af8424dd53e560b1933f87ba650d8bf57c83ca5a04600eefb31f416aabbae7
 NODE_X86_64_MAX_BYTES=67108864
 NODE_AARCH64_URL=https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz
 NODE_AARCH64_SHA256=5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7
+NODE_AARCH64_BINARY_SHA256=23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477
 NODE_AARCH64_MAX_BYTES=67108864
 CODEX_VERSION=0.150.1
 CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz
 CODEX_X86_64_SHA256=00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17
+CODEX_X86_64_BINARY_SHA256=abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386
 CODEX_X86_64_MAX_BYTES=134217728
 CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz
 CODEX_AARCH64_SHA256=1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639
+CODEX_AARCH64_BINARY_SHA256=7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb
 CODEX_AARCH64_MAX_BYTES=134217728
 RUSTDESK_VERSION=1.4.9
 RUSTDESK_X86_64_URL=https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm