[nulluserid]

Fix the shipped artifact, not only source

Follow-up to @HANCORE-linux's second review on omacom/omarchy-plugin-marketplace#13443. The previous source audit never checked the statically linked runtime/modules against current advisories. It also failed to catch manifest 1.5.0 vs binary/tag 1.5.1. Those were gaps in our submission process.

Repair

• Rebuild the bundled daemon with Go 1.27.3, fixing GO-2026-6809 / CVE-2026-111943 (compromised CA intermediate distrust).
• Update x/net to v0.62.0, with required x/sys v0.49.0 and x/text v0.43.0. Keep gRPC/protobuf unchanged. Scanning found additional advisories in the old dependencies; these are scanner findings, not a claim of independently demonstrated exploit paths.
• Align manifest and executable at 1.5.2, require the exact compiler/stamp, stop tidying dependencies during builds, and compare a clean rebuild with the committed executable.
• Add fail-closed source and binary govulncheck, race tests/vet/module checks, and pinned CI on PR/main/manual/daily runs. Document separate source/artifact coverage and final-SHA submission evidence.
• Fix upgrade permissions for existing state roots/temp/event files; private service umask.
• Reject installer runs outside the actual canonical plugin checkout before changing services/config.
• Bound egress responses to 1 MiB, refuse redirects, retain last-good evidence on failure, and reject URL/scheme targets at the shared dial boundary without forbidding explicitly configured hostnames.

Verification

• Old source/binary scans fail; corrected source and bundled binary report No vulnerabilities found with govulncheck v1.9.0 and the official advisory data fetched this session.
• go test -race -count=1 ./..., go vet ./..., module checksum/tidiness and formatting checks pass.
• Fresh protobuf generation and deterministic rebuild match the committed executable byte-for-byte.
• Negative checks reject changed manifest/binary/stamp/compiler and scanner errors.
• New privacy regression fails against old source and passes against corrected source; HTTP/target and installer location/side-effect tests pass.
• Isolated real-binary -once smoke writes valid OFFLINE state, root 0700/status 0600. omarchy plugin validate . exits 0. No QML changes or production service/config changes in this round.

Binary SHA-256: b9bbbcb5b395532411c9859bf996340fb21751c5b2ceaafca01f29bcbbbf0737.

Residual limits: a clean advisory scan is not a complete security audit; ifconfig.co remains a trusted HTTPS provider and the dish API remains plaintext unauthenticated LAN gRPC. Scheduled failures require owner attention.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T22:41:40.737438Z	f5d7fce	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.