Conversation
The #802 row said carabiner-dev's nested installers curl-and-chmod without verification, with the upstream issue open. That issue is closed and install/download-and-verify now defaults verify to true against SLSA provenance, so the row was steering reviewers to re-raise a settled finding. Adds rows for the five-PR carabiner sweep, the CRLF false positive behind #1283, and the cargo-rail-action hold. Each carries the check that decided it: compare blob SHAs rather than a compare's file list; diff with --strip-trailing-cr; and read the install script yourself, because verify reports "all verified" whenever checksum verification is present without reasoning about the checksum's trust root. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
#802row said carabiner-dev's nested installerscurl + chmodwithout verification, with upstream issuecarabiner-dev/actions#51open. That issue is closed, andinstall/download-and-verifynow defaultsverifyto true, checking SLSA provenance via a bootstrapped ampel trust anchor against a pinned policy revision with a sigstore signer spec. The row was steering reviewers to re-raise a settled finding against current versions, so it now says so and points at the new row.Three precedents added, each recording the check that actually decided it:
action.ymlat the old and new pin, which the compare's file list did not show; comparing blob SHAs is what settled it.whatwg-url@5.0.0publisheslib/url-state-machine.jswith CRLF, git normalises to LF on commit, so the committed blob can never byte-match the tarball.diff --strip-trailing-crsettles it in one command. Fix in verify-action-build: credit vendored files git normalised from CRLF #1297.cargo-rail-action, held for release-asset provenance. The reusable lesson:verifyreports "no downloads or all verified" whenever checksum verification is present, without reasoning about where the checksum came from - so the install script still has to be read. Same shape as the existing mise-action row (Add jdx/mise-action to the GitHub Actions allowlist #1013).Test plan: documentation only, no behaviour change.
prek run --files .claude/skills/analyze-action-pr/SKILL.mdpasses. Every claim is anchored to a merged PR, a closed upstream issue, or a byte count reproduced during the review that prompted it.🤖 Generated with Claude Code