Verify cache archive digest before restore (#2) #7

Merged

stephen merged 1 commit from feat/2-verify-archive-digest into main

2026-06-16 23:50:40 +00:00

stephen commented

2026-06-16 23:46:13 +00:00

Owner

What changed

Caches restore from shared object storage with no integrity check, so a corrupted or poisoned object expands straight into the workspace/home cache paths (#2). Save now writes a sha256 sidecar (<archive>.sha256) beside each archive, and restore recomputes the downloaded archive's digest and compares it against the sidecar before extracting.

A digest mismatch fails closed: the restore aborts rather than extracting untrusted bytes.
An archive with no sidecar (saved before this change) restores with a warning by default; RASTER_CACHE_REQUIRE_DIGEST=true refuses unverified archives outright (missing-but-expected fails closed too).
A present-but-malformed sidecar is treated as a failed check, not a missing one.
The sidecar is filtered out of restore-key listings by the existing .tar.gz/.tar.zst extension check, so it is never matched as a cache entry.

How it was tested

make lint clean (actionlint/yq absent locally and skipped)
make test green (62 tests)
new behavior has a test: matching digest round-trips and verifies, a tampered archive is refused with nothing written, a missing sidecar restores with a warning by default and is refused under RASTER_CACHE_REQUIRE_DIGEST, plus unit coverage for the sidecar parser and that save writes a digest matching the archive bytes
e2e workflow green on a runner

CHANGELOG updated? yes

**What changed** Caches restore from shared object storage with no integrity check, so a corrupted or poisoned object expands straight into the workspace/home cache paths (#2). Save now writes a sha256 sidecar (`<archive>.sha256`) beside each archive, and restore recomputes the downloaded archive's digest and compares it against the sidecar before extracting. - A digest mismatch fails closed: the restore aborts rather than extracting untrusted bytes. - An archive with no sidecar (saved before this change) restores with a warning by default; `RASTER_CACHE_REQUIRE_DIGEST=true` refuses unverified archives outright (missing-but-expected fails closed too). - A present-but-malformed sidecar is treated as a failed check, not a missing one. - The sidecar is filtered out of restore-key listings by the existing `.tar.gz`/`.tar.zst` extension check, so it is never matched as a cache entry. **How it was tested** - [x] `make lint` clean (actionlint/yq absent locally and skipped) - [x] `make test` green (62 tests) - [x] new behavior has a test: matching digest round-trips and verifies, a tampered archive is refused with nothing written, a missing sidecar restores with a warning by default and is refused under `RASTER_CACHE_REQUIRE_DIGEST`, plus unit coverage for the sidecar parser and that save writes a digest matching the archive bytes - [ ] e2e workflow green on a runner **CHANGELOG updated?** yes

stephen added 1 commit

2026-06-16 23:46:13 +00:00

Verify cache archive digest before restore

test / e2e (pull_request) Successful in 6s

Details

test / unit (pull_request) Successful in 6s

Details

test / e2e-post-save (pull_request) Successful in 5s

Details

dd0214738f

Caches restore from shared object storage with no integrity check, so a
corrupted or poisoned object expands straight into the workspace. Save now
writes a sha256 sidecar (<archive>.sha256) beside each archive, and restore
recomputes the downloaded archive's digest and compares it before extracting.

A mismatch fails closed (the restore aborts rather than extracting untrusted
bytes). An archive with no sidecar (saved before this change) restores with a
warning by default; RASTER_CACHE_REQUIRE_DIGEST=true refuses unverified
archives outright. The sidecar is filtered out of restore-key listings by the
existing extension check, so it is never treated as a cache entry.

stephen merged commit f059261c70 into main

2026-06-16 23:50:40 +00:00

stephen referenced this pull request from a commit

2026-06-16 23:50:41 +00:00

Verify cache archive digest before restore (#2) (#7)

stephen referenced this pull request

2026-06-17 18:23:33 +00:00

Reject special files and cap restore size (#2, #3) #9