Found in the closing security audit; the mirror of #819's fix, which only guarded the other direction.
os_update_needs_confirmation() (pithead ~L2209) returns true only when a debug box takes a non-debug bundle:
[ "$1" = "debug" ] && [ "$2" != "debug" ]
The reverse — a hardened, shell-less release box installing a debug bundle — passes with no confirmation. A debug bundle unconditionally bakes a standing root authorized_keys and enables sshd (os/rootfs/Dockerfile ~L208-221). So one validly-signed debug bundle flips a locked-down appliance into one with a permanent root SSH backdoor, and the CLI says nothing.
This requires a signed debug bundle to exist, so it compounds with #850 (RAUC key custody): a leaked/misused build key, a compromised CI runner, or an insider with build access turns "can sign a bundle" into "can silently backdoor any release box." #819 correctly stops a debug box from losing its channel; this is the same class in the direction that gains a channel, which is the more dangerous one.
Fix: confirm (or refuse without an explicit override) on any transition INTO debug — i.e. whenever the bundle variant is debug and the running variant is not, and on unknown-variant bundles. The gate should treat "about to enable SSH on a box that had none" as the event needing consent, not just "about to remove SSH."
🤖 Generated with Claude Code
Found in the closing security audit; the mirror of #819's fix, which only guarded the other direction.
os_update_needs_confirmation()(pithead ~L2209) returns true only when a debug box takes a non-debug bundle:The reverse — a hardened, shell-less release box installing a debug bundle — passes with no confirmation. A debug bundle unconditionally bakes a standing root
authorized_keysand enables sshd (os/rootfs/Dockerfile ~L208-221). So one validly-signed debug bundle flips a locked-down appliance into one with a permanent root SSH backdoor, and the CLI says nothing.This requires a signed debug bundle to exist, so it compounds with #850 (RAUC key custody): a leaked/misused build key, a compromised CI runner, or an insider with build access turns "can sign a bundle" into "can silently backdoor any release box." #819 correctly stops a debug box from losing its channel; this is the same class in the direction that gains a channel, which is the more dangerous one.
Fix: confirm (or refuse without an explicit override) on any transition INTO debug — i.e. whenever the bundle variant is debug and the running variant is not, and on unknown-variant bundles. The gate should treat "about to enable SSH on a box that had none" as the event needing consent, not just "about to remove SSH."
🤖 Generated with Claude Code