Repository navigation
Conversation
a-d-j-i
added this pull request to stack #54
October 9, 2026 22:22
a-d-j-i
force-pushed
the
feat/signer-identity-tofu
branch
4 times, most recently
from
October 16, 2026 15:50
c81c361 to
5b40058
Compare
a-d-j-i
force-pushed
the
feat/signer-identity-tofu
branch
from
October 16, 2026 18:48
5b40058 to
8ffb698
Compare
Base automatically changed from
refactor/verification-status-shortcut
to
main
October 19, 2026 16:47
Pins the manifest signer on first install (TOFU) and treats a subsequent
disagreement between the bootstrap config and the stored anchor as a
manifest-level violation.
storage/manifest-store.js:
- New IDB key 'active-identity' holding
{ signatureType, identity, enrolledAt }.
- addLatest(manifest, signer) now writes the signer pair onto each trusted-
manifest entry (signatureType, signerIdentity) and, atomically in the
same tx, seeds active-identity on first write — can't leave the manifest
and anchor out of sync on a crash.
- New getActiveIdentity() with a cache mirror.
manifest-loader.js:
- storeManifestFromResponse now resolves the anchor before verifying.
Three paths:
1. No anchor (first install) → trust config.identity, verify, store
manifest + seed anchor atomically.
2. Anchor present AND matches config → verify against the anchor
(equivalent to current behavior).
3. Anchor present AND disagrees with config → return
MANIFEST_UNTRUSTED + reason='SIGNER_CHANGED' without fetching or
verifying. Bootstrap-level identity swap is a rotation signal the
user has to accept explicitly.
- verifyManifestSignature receives the anchor identity (not the config),
so a manifest signed by a different key than the pinned anchor also
fails even when the config appears to agree.
a-d-j-i
force-pushed
the
feat/signer-identity-tofu
branch
from
October 19, 2026 16:47
8ffb698 to
17ea1dc
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins the manifest signer on first install (TOFU) and treats a subsequent disagreement between the bootstrap config and the stored anchor as a manifest-level violation.
storage/manifest-store.js:
manifest-loader.js: