Skip to content

fix: authenticate cached ingredient files before installation - #17

Open
ahrazzle wants to merge 1 commit into
mainfrom
fix/verify-cache-worktree
Open

ahrazzle wants to merge 1 commit into
mainfrom
fix/verify-cache-worktree

Conversation

@ahrazzle

Copy link
Copy Markdown
Contributor

Fixes #16.

Compare cache files directly with the pinned Git blob hashes and executable modes before installation. Refuse extra, missing, altered, or index-hidden files. Symlink-containing ingredients now fail closed because the current copy path dereferences links; the current ingredient trees contain no tracked symlinks.

Validation: all five new cache/link regression scenarios install unverified bytes on the base revision and are refused before target creation with this fix. The complete unit suite passes 45 tests. The existing full-kit failure remains tracked in #14.

Automated posting by agentic team with human oversight.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Offline cache verification accepts modified and unpinned ingredient files

1 participant