Only bundle.tar.gz is hashed; individual files and the manifest itself are not authenticated.
Proposal
Extend manifest.json to include per-file hashes (web assets, API package, entrypoint).
Add optional ed25519 signature over manifest.json; verify if signature + pubkey provided (e.g., /etc/pikit/public.key).
Keep backward compatibility: verify bundle hash today; prefer full-file hashes when present; signature optional but logged when missing.
Document key management and how to rotate keys.
Acceptance
Updater refuses install if any listed file hash or manifest signature fails.
Backward-compatible with existing unsigned manifests.
Tests cover valid, tampered, and missing-signature cases.
Problem
- Only bundle.tar.gz is hashed; individual files and the manifest itself are not authenticated.
Proposal
- Extend manifest.json to include per-file hashes (web assets, API package, entrypoint).
- Add optional ed25519 signature over manifest.json; verify if signature + pubkey provided (e.g., /etc/pikit/public.key).
- Keep backward compatibility: verify bundle hash today; prefer full-file hashes when present; signature optional but logged when missing.
- Document key management and how to rotate keys.
Acceptance
- Updater refuses install if any listed file hash or manifest signature fails.
- Backward-compatible with existing unsigned manifests.
- Tests cover valid, tampered, and missing-signature cases.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
Proposal
Acceptance