Fix: Harden pinned runtime activation

2026-08-27 08:32:44 -04:00
parent 8264ca6320
commit 31fc1d3eaa
5 changed files with 501 additions and 95 deletions
@@ -64,6 +64,14 @@ Artifact digests were checked with `sha256sum ARTIFACT` against the lowercase
 64-hex values in `installers.conf`; all runtime downloads also enforce the
 recorded byte limit before atomic replacement.

+The `*_BINARY_SHA256` values are the SHA-256 digests of the exact executable
+bytes selected from each verified runtime archive. They were derived without
+executing the artifacts: `tar -xO` selected Node's `bin/node` and Codex's
+`bin/codex`, while `unzip -p` selected Bun's `bun`. Runtime version directories
+record both the reviewed archive digest and this reviewed installed-byte digest
+in `.panama-provenance`; later runs require the receipt and re-hash the installed
+binary before treating an existing directory as trusted.
+
 ## Rotation policy

 Do not replace a key on an automated update. A key rotation is a reviewed