M13-02D Status

status: done
task: signature verification binds declared content
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

Scope

verifyScriptManifestSignature now verifies the canonical per-script manifest input with the trusted ED25519 key. The input includes the declared source SHA-256 and all policy-relevant fields, while excluding only the signature field itself. A source hash or signature mutation therefore returns SCRIPT_SIGNATURE_INVALID; revoked or otherwise ineligible keys return SCRIPT_POLICY_DENIED. Verification remains a policy gate and does not enable script execution.

Evidence

node --test --test-name-pattern=M13-02D web/tests/unit/script-trust-policy.test.mjs passed the M13-02D case (1 passed, 3 unrelated cases skipped).
WEB_TEST_PORT=5520 npm --prefix web run test:script-signature passed the focused Node case and production Chromium Worker E2E (1/1).
node tools/web/check-script-signature.mjs passed: script-signature-ok verified=SCRIPT_SIGNATURE_VERIFIED sourceHashChanged=SCRIPT_SIGNATURE_INVALID revoked=SCRIPT_POLICY_DENIED next=M13-02E.
npm --prefix web run typecheck, npm --prefix web run lint, npm --prefix web run build and git diff --check passed.

Artifact Hashes

protocol: 6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2
worker: f4e8ff45d06efcfa9e634ef28e654241d70554ed05dfe9c3fecd9f6eef166ce0
checker: 2d6e7b403dd6d401eb1a41978016b40bd1fb86120464e09f185de4445c177fa4
unit: aac3ff0a1c7ae27e35112614bedabc02bb248882ec9b0b52d65f9794d06830d8
e2e: 8a882fc8fa2c0c4e2eab3660810cec0f60d2f7475f62a1bb406fc3b2bdf60882
report: 957daf8e5899714cc5ce253b1f0fb2b258f1cc966238fff31e2626f8f56feb3a
manifest: c6b79a77e4b7ffe5f4a9ba785a30305f9cf6e86caf89b38a4b303a86ab662a31

Next Task

M13-02E: permission default-minimization and unknown-permission blocking.

Rollback

Remove the M13-02D checker, report, manifest, status entry and focused package command; restore M13-02C as the queue tail and move the machine queue back to M13-02D. No parity ledger rollback is required.

2.1 KiB Raw Blame History