Repository navigation
fix(security): adopt patched Node qualification runtime - #1152
Merged
Merged
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
PR SummaryMedium Risk Overview GitHub Actions workflows ( Downstream gates stay aligned: Reviewed by Cursor Bugbot for commit b97ee69. Bugbot is set up for automated code reviews on this repo. Configure here. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR updates CI and the universal macOS qualification runtime to Node 26.12.1 with matching checksums, manifests, archive names, and fixtures. Example: Build the macOS qualification Node app.
Review scores
ProductKind: Maintenance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: main still selects Node 26.9.0, and this coordinated security update preserves the existing verification gates without an actionable patch defect. Priority: P1 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherGitHub workflows select Node for repository tasks; the qualification builder assembles official macOS binaries into an app whose identity is checked by the terminal artifact producer and validator. flowchart LR
A[Official Node archives] --> B[Pinned runtime builder]
B --> C[Universal qualification app]
C --> D[Terminal artifact producer]
D --> E[Artifact manifest validator]
F[CI Node selectors] --> G[Repository validation]
Technical reviewBest possible solution: Land the coordinated runtime update after the existing checks pass, preserving the current signing and release gates. Do we have a high-confidence way to reproduce the issue? Main's selection of Node 26.9.0 is directly source-verifiable; supplied native evidence demonstrates candidate certificate rejection but does not establish a matched old-Node reproduction. Is this the best way to solve the issue? Updating the existing producer, consumers, and fixtures together is the smallest complete fix and preserves their established trust checks. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 0ecd54a6074d. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
Review metrics
LabelsLabel changes: No label changes. Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReviewed October 26, 2026, 3:40 AM ET / 07:40 UTC (Revision 3). |
Contributor
Author
|
Rebuilt qualification runtime evidence for final head Native macOS27 ARM64; production builder mode (testMode=false, inputOverrides=false), exit0 at 2026-10-26T06:42:07.320039+00:00. Universal executable (ARM64 executed): SHA256 Exact official archive inputs: {
"arm64": {
"url": "https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-arm64.tar.gz",
"archive_sha256": "1901d539912c02afa10d1cc126943a8855a7eedebe830119463470db5e6c59e8",
"binary_sha256": "06eb3f5762c2b6890e99d03f931bf01d9b20fd341dec1a8c1ef5c1809e66102b"
},
"x86_64": {
"url": "https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-x64.tar.gz",
"archive_sha256": "b85c2ea4420ad0bc4abf2dc6cf1f55130ed681f1cabf60cf3f526e4c9e2712ff",
"binary_sha256": "4a1cb2b18065f49938d650eceedf4557a4b5561ab941ab66cb4ab3f4b38c8232"
}
}The actual rebuilt executable uses strict Controls: each candidate mode accepts legitimate public HTTPS (HTTP200), legitimate private-CA HTTPS (HTTP200/body=legitimate-private-control), and rejects wrong hostname with ERR_TLS_CERT_ALTNAME_INVALID. Default mode private control supplies its own CA; it does not assert system-root installation. Explicit CA/secure-context use complete historical issuer inputs; extra-CA uses the recorded union bundle. Candidate raw incident results (all14hosts in each of four modes): {
"mode": "default",
"runtime": {
"version": "v26.12.1",
"openssl": "3.5.9",
"node": "v26.12.1",
"platform": "darwin",
"arch": "arm64"
},
"incident": [
{
"host": "dv-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-aaa-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
}
],
"public": {
"accepted": true,
"status": 200,
"authorized": true
},
"private": [
{
"host": "localhost",
"accepted": true,
"status": 200,
"authorized": true,
"privateBody": "legitimate-private-control"
},
{
"host": "different.invalid",
"accepted": false,
"code": "ERR_TLS_CERT_ALTNAME_INVALID",
"error": "Hostname/IP does not match certificate's altnames: Host: different.invalid. is not in the cert's altnames: DNS:localhost"
}
]
}{
"mode": "explicit-ca",
"runtime": {
"version": "v26.12.1",
"openssl": "3.5.9",
"node": "v26.12.1",
"platform": "darwin",
"arch": "arm64"
},
"incident": [
{
"host": "dv-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-aaa-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
}
],
"public": {
"accepted": true,
"status": 200,
"authorized": true
},
"private": [
{
"host": "localhost",
"accepted": true,
"status": 200,
"authorized": true,
"privateBody": "legitimate-private-control"
},
{
"host": "different.invalid",
"accepted": false,
"code": "ERR_TLS_CERT_ALTNAME_INVALID",
"error": "Hostname/IP does not match certificate's altnames: Host: different.invalid. is not in the cert's altnames: DNS:localhost"
}
]
}{
"mode": "secure-context",
"runtime": {
"version": "v26.12.1",
"openssl": "3.5.9",
"node": "v26.12.1",
"platform": "darwin",
"arch": "arm64"
},
"incident": [
{
"host": "dv-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-aaa-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
}
],
"public": {
"accepted": true,
"status": 200,
"authorized": true
},
"private": [
{
"host": "localhost",
"accepted": true,
"status": 200,
"authorized": true,
"privateBody": "legitimate-private-control"
},
{
"host": "different.invalid",
"accepted": false,
"code": "ERR_TLS_CERT_ALTNAME_INVALID",
"error": "Hostname/IP does not match certificate's altnames: Host: different.invalid. is not in the cert's altnames: DNS:localhost"
}
]
}{
"mode": "extra",
"runtime": {
"version": "v26.12.1",
"openssl": "3.5.9",
"node": "v26.12.1",
"platform": "darwin",
"arch": "arm64"
},
"incident": [
{
"host": "dv-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-aaa-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3b-noct-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "dv-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ev-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3b-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-aaa-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
},
{
"host": "ov-g3c-emudhra.we-have-a-problem.com",
"accepted": false,
"code": "CERT_REVOKED",
"error": "certificate revoked"
}
],
"public": {
"accepted": true,
"status": 200,
"authorized": true
},
"private": [
{
"host": "localhost",
"accepted": true,
"status": 200,
"authorized": true,
"privateBody": "legitimate-private-control"
},
{
"host": "different.invalid",
"accepted": false,
"code": "ERR_TLS_CERT_ALTNAME_INVALID",
"error": "Hostname/IP does not match certificate's altnames: Host: different.invalid. is not in the cert's altnames: DNS:localhost"
}
]
}Independent accepted-chain/hostname control: published pre-repair OpenClaw Bun1.4.4 fork, SHA256 [
{
"host": "dv-g3b-aaa-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "7e02622ab6d745c1edb4b431bb1c551e667305c3dd3eb0c7cc6dfdb523807424",
"spkiSHA256": "3a8db3240fead2b9e2d090337cab06d0db55b9968db2725de153143d5c7fcdde"
},
{
"certificateSHA256": "45a883f349aedfd5f3a649b5498ffb121712ba8b448f3f2a91dbc5a766fcddbe",
"spkiSHA256": "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105"
},
{
"certificateSHA256": "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"spkiSHA256": "bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3"
}
]
},
{
"host": "dv-g3b-aaa-noct-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "5510ecf5764dee8dfe9468ae2d7323da21fcd5530889906540a2f8725c6f74db",
"spkiSHA256": "02d0cef99bfa58c570b93d0905af1a725c5a55a087cfbe1a9c6b2a4e74d940f5"
},
{
"certificateSHA256": "45a883f349aedfd5f3a649b5498ffb121712ba8b448f3f2a91dbc5a766fcddbe",
"spkiSHA256": "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105"
},
{
"certificateSHA256": "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"spkiSHA256": "bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3"
}
]
},
{
"host": "dv-g3b-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "9dcb21b1841d75313b3c888f4bb9cc01f8f51379a76fbaa241ca492b668839e7",
"spkiSHA256": "27a1f73e0e681ca0d5e8cb036a111944cef09f1ee170a6f6df0023b97b290a14"
},
{
"certificateSHA256": "42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493",
"spkiSHA256": "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105"
},
{
"certificateSHA256": "3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd",
"spkiSHA256": "c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9"
},
{
"certificateSHA256": "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"spkiSHA256": "8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782"
}
]
},
{
"host": "dv-g3b-noct-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "0cbfe22b824385823fd3bf4be4d131e8901342933a7feef1cf8b3110b8e44a70",
"spkiSHA256": "844f3fa44fa1e71dd80c69046456d3781e78cf21e49ef649784bab3c9b4cc876"
},
{
"certificateSHA256": "42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493",
"spkiSHA256": "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105"
},
{
"certificateSHA256": "3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd",
"spkiSHA256": "c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9"
},
{
"certificateSHA256": "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"spkiSHA256": "8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782"
}
]
},
{
"host": "dv-g3c-aaa-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "9200d153c3cac272cc06bf68f9ea163fc24659fc3331e77668236fe00645ae52",
"spkiSHA256": "37170552befaae4d481cb7ba6e751c6e816f2cc5b26c342ed56a28bf38a175ec"
},
{
"certificateSHA256": "62b7f9868263f72f6911fc78ceaf72c1979158b7368bf648683bb2aa39b02e72",
"spkiSHA256": "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f"
},
{
"certificateSHA256": "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"spkiSHA256": "bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3"
}
]
},
{
"host": "dv-g3c-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "346cdd962e97189b59aee5526d1ae8fa714bb1a64094dfa67bef768ee93f36b5",
"spkiSHA256": "3664c953170348edae3994e80efafd61315caebc321f1a8d7f5af680669d4036"
},
{
"certificateSHA256": "0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19",
"spkiSHA256": "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f"
},
{
"certificateSHA256": "3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd",
"spkiSHA256": "c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9"
},
{
"certificateSHA256": "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"spkiSHA256": "8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782"
}
]
},
{
"host": "ev-g3b-aaa-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "bc88231a840e54cced148da48806169e8d0b1c0a96267a427aeccda9d10e6145",
"spkiSHA256": "0b80b5bca4e2f21ccc4857f3525171a422e80ca18211f0b63cbdc429858bf357"
},
{
"certificateSHA256": "579480aea166290bd3c643589e795fc0d0e54e86505d180f1dff99efd3199512",
"spkiSHA256": "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41"
},
{
"certificateSHA256": "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"spkiSHA256": "bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3"
}
]
},
{
"host": "ev-g3b-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "66374ae64962c437bd815a2aae546c76e30c2eafac8335192c8e517c15a246ed",
"spkiSHA256": "a71197075e9c9d022e0d625af25a96a24ef8c70251c86f61fe2068bc0f3a7bdf"
},
{
"certificateSHA256": "e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838",
"spkiSHA256": "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41"
},
{
"certificateSHA256": "3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd",
"spkiSHA256": "c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9"
},
{
"certificateSHA256": "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"spkiSHA256": "8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782"
}
]
},
{
"host": "ev-g3c-aaa-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "bcd6ab59ea95fd520bfe7709679b1f682abbd79c77367e84e25415b91de37753",
"spkiSHA256": "cf1b4dfb8c8ce14bcaf8b4558d0ed5443a514ed8d54d803656d350371d4c6715"
},
{
"certificateSHA256": "fd9d5c2dbbd4995ab69b8d50c439d9527b00529199c2fd01b2174eb58f07021f",
"spkiSHA256": "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0"
},
{
"certificateSHA256": "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"spkiSHA256": "bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3"
}
]
},
{
"host": "ev-g3c-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "ccd80467f9cac38f115dcb6e4f57e4d74f5efa519814ea934aeb3be53b83a191",
"spkiSHA256": "b74e43c738db7d9e909cadcc3376d6cb4552092cb1ccfac7a7063eec1af9cc70"
},
{
"certificateSHA256": "432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3",
"spkiSHA256": "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0"
},
{
"certificateSHA256": "3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd",
"spkiSHA256": "c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9"
},
{
"certificateSHA256": "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"spkiSHA256": "8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782"
}
]
},
{
"host": "ov-g3b-aaa-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "21f57f83631a93c98e867050075746b3361e0433c9e0e969462852476784f6f0",
"spkiSHA256": "8d6fe8fb0a4a01e31dc4ca5ceb534c492d7933934d58965b7512c154512afde2"
},
{
"certificateSHA256": "5f1ded4dd590af74631290cf073b122a2aac6a1fa479778a0bd43579bd832699",
"spkiSHA256": "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b"
},
{
"certificateSHA256": "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"spkiSHA256": "bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3"
}
]
},
{
"host": "ov-g3b-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "f3c3c15bc7edf2b3ebdc922af112f2a0c414eb509901099ef0488c0942e77efe",
"spkiSHA256": "a7789d73777f937d30d460bb63140cf96a7993cf7eb3ed524c7934e8b13bcdd6"
},
{
"certificateSHA256": "98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b",
"spkiSHA256": "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b"
},
{
"certificateSHA256": "3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd",
"spkiSHA256": "c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9"
},
{
"certificateSHA256": "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"spkiSHA256": "8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782"
}
]
},
{
"host": "ov-g3c-aaa-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "59cf0386b56bc2414a0c06241ea9e25e01a9c93bac7a596648747f9d0ded4906",
"spkiSHA256": "f86d8ec8528a4b8db4ed56161a804e7e02582f1d0a4f7835ee001899260d2b0c"
},
{
"certificateSHA256": "7485b51c0ed192878fa1d2f948fb529ae1842cc5086c4b67f7be5b2039de9489",
"spkiSHA256": "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8"
},
{
"certificateSHA256": "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"spkiSHA256": "bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3"
}
]
},
{
"host": "ov-g3c-emudhra.we-have-a-problem.com",
"authorized": true,
"status": 200,
"chain": [
{
"certificateSHA256": "4314941cf242a4ea4149aa7e9cdf77a15de2771a79984b809fc04443fea013c8",
"spkiSHA256": "5cf80e7da3a0d79957e629a882ca3cd4b8f4f69b5395aa1331e29c7f566ed835"
},
{
"certificateSHA256": "cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f",
"spkiSHA256": "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8"
},
{
"certificateSHA256": "3094025792039a68af6e553686410bdab7c0d4a36b9084cba64202e35d6ebbdd",
"spkiSHA256": "c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9"
},
{
"certificateSHA256": "86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"spkiSHA256": "8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782"
}
]
}
]Evidence artifact hashes: Remaining merge qualification: full-Xcode native Swift/lint jobs and required owner/security review. This trace does not establish signing/notarization, resumed sessions, other architecture execution or public delivery. |
Contributor
Author
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Peekaboo still selects Node 26.9.0 for CI and builds its qualification runtime from that older release. Its terminal artifact validators bind the same older binary identities.
Change
Adopt official Node 26.12.1 across the existing selectors, universal qualification-runtime builder, artifact manifests and owning tests. Keep checksum, source-manifest, signing, notarization and release gates intact; no submodule or release publication changes.
Validation
a86ff3ec10b5086ce10ae871f8c6b23bed8ac629fb6a91611cbcfe07afaf6460(297440176 bytes); ARM64 execution reports Node 26.12.1/OpenSSL 3.5.9.CERT_REVOKEDin default, explicit CA, secure-context and extra-CA modes. Legitimate public/private CA connections pass, wrong hostname fails. Old-runtime positive control authorizes all 14 with the same complete issuer inputs; fresh peer DER/SPKI identities match verified incident evidence.git diff --checkpasses. Simplification retained only the coherent runtime pin/consumer cutover.Remaining qualification
This guest has Command Line Tools, not full Xcode: SwiftLint cannot load SourceKit and Swift Foundation compilation cannot load TestingMacros; downstream CLI Swift tests are not established. Ordinary PR native CI must provide those gates. No native Intel execution, signed/notarized app, public release or deployed-fleet delivery is claimed. The assembled runtime is a pre-signing proof artifact, not a shippable app.
Inspectable rebuilt-runtime proof
Exact rebuilt executable, raw incident results in four CA modes, accepted-chain DER/SPKI controls and artifact hashes. Full-handshake scope only; pre-upgrade resumed sessions are excluded/unverified. The accepted-chain control uses the pre-repair Bun fork, not old Node. Full-Xcode gates and required owner review remain separate.