rasterstate/cache-action
2
0
Fork 0
Code Issues Pull requests Releases Activity Actions

Verify cache archive digest before restore #2

New issue
Closed
opened 2026-06-16 17:54:52 +00:00 by stephen · 0 comments
stephen commented 2026-06-16 17:54:52 +00:00
Owner
Copy link

Why

Caches are restored from shared object storage, but cache-action has no metadata digest check before extracting an archive. A poisoned or corrupted object can be expanded directly into the workspace/home cache paths.

Verified

  • git grep origin/main -- src/lib digest sha256 shows key/version hashing but no archive digest sidecar verification.
  • src/lib/restore-impl.js downloads and extracts the matched object directly.
  • No existing cache-action issues are filed.

Build

  • Write a digest sidecar or object metadata on save.
  • Verify digest before restore and fail closed on mismatch.
  • Add tests for corrupt object and missing legacy digest behavior.
## Why Caches are restored from shared object storage, but cache-action has no metadata digest check before extracting an archive. A poisoned or corrupted object can be expanded directly into the workspace/home cache paths. ## Verified - `git grep origin/main -- src/lib digest sha256` shows key/version hashing but no archive digest sidecar verification. - `src/lib/restore-impl.js` downloads and extracts the matched object directly. - No existing cache-action issues are filed. ## Build - Write a digest sidecar or object metadata on save. - Verify digest before restore and fail closed on mismatch. - Add tests for corrupt object and missing legacy digest behavior.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
wip/claude-4/rasterstate-cache-action
wip/codex-1/rasterstate-cache-action
feat/5-windows-cache-support
feat/cache-restore-integrity
feat/verified-confined-restore
feat/4-retention-prune
feat/2-verify-archive-digest
feat/3-confine-restore
fix-local-cache-race
v1.1.0
v1
v1.0.0
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rasterstate/cache-action#2
No description provided.