[bug] Sidecar-less artifacts are permanently un-downloadable (digest fallback is dead code) #10

New issue

Closed

opened 2026-06-23 20:14:55 +00:00 by stephen · 0 comments

stephen commented

2026-06-23 20:14:55 +00:00

Owner

Autonomous audit finding (needs triage — possibly intended fail-closed).

src/lib/download-impl.js:97-100 returns a meta object with no digest for sidecar-less artifacts, but verifyDigest (:161-166) throws when the digest is absent. So the documented sidecar-less fallback path always throws → dead code. If fail-closed-on-missing-digest is intended (per the #9 hardening), remove/relabel the fallback so it isn't presented as supported; if sidecar-less downloads should work, the fallback must skip verification explicitly.

Autonomous audit finding (needs triage — possibly intended fail-closed). `src/lib/download-impl.js:97-100` returns a meta object with no `digest` for sidecar-less artifacts, but `verifyDigest` (:161-166) throws when the digest is absent. So the documented sidecar-less fallback path always throws → dead code. If fail-closed-on-missing-digest is intended (per the #9 hardening), remove/relabel the fallback so it isn't presented as supported; if sidecar-less downloads should work, the fallback must skip verification explicitly.

stephen referenced this issue from a pull request that will close it,

2026-06-24 18:35:38 +00:00

Clarify sidecar fail-closed: replace dead sidecar-less fallback with a clear error #12

stephen closed this issue

2026-06-24 19:21:11 +00:00