P1: Proxy checksum verification robustness (deterministic source) #21

Activity

1. Kinin-Code-Offical

   added

   Priority: P1

   Type: enhancement

   Area: security

   P1

   release

   bugSomething isn't workingSomething isn't working

   on Dec 21, 2025
2. Kinin-Code-Offical

   added this to the P1 – Operations & Supportability milestone on Dec 21, 2025
3. Kinin-Code-Offical commented on Dec 22, 2025

   

   Kinin-Code-Offical

   on Dec 22, 2025

   OwnerAuthor

   More actions

   Plan:

   • Replace release-body checksum parsing with deterministic checksum fetch from GCS (.sha256 sidecar for proxy binary).
   • Fail fast with clear error if checksum file missing or malformed.
   • Keep GitHub release lookup for tag validation; remove body parsing dependency.

   Risks:

   • If GCS checksum file is unavailable for a version, proxy update will fail instead of skipping verification.

   Tests:

   • npm ci
   • npm run lint
   • npm test
   • npm run build
   • npm run package
   • npm run smoke:exe
4. Kinin-Code-Offical

   closed this as completedin #38on Dec 22, 2025
5. Kinin-Code-Offical commented on Dec 22, 2025

   

   Kinin-Code-Offical

   on Dec 22, 2025

   OwnerAuthor

   More actions

   PR merged: #38
   Merge commit: ab17c22
   Tests: npm ci, npm run lint, npm test, npm run build, npm run package, npm run smoke:exe