From ae54f9769b3ec2939774641cc20165acf1719e97 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Sun, 2 Aug 2026 04:52:24 +0500 Subject: [PATCH] fix(status): fail closed when the baseline cannot identify the binary software-status reported current=true after the managed executable was replaced. The check that would have caught it does exist: if binary_sha != executable_baseline.get("sha256"): drift.append("baseline_binary_sha256") but the whole block sits behind `if isinstance(executable_baseline, dict)`, and only darwin-arm64 declares that object. The five remaining assets -- every Linux one among them -- have no `executable` baseline, so on those platforms the strongest verification silently disappeared and status still answered current. The manifest cannot stand in for it. It lives beside the binary and is just as writable, so whoever replaced one replaced both; the stub in the private slice does exactly that and was reported as current. A baseline that omits the extracted-binary identity cannot answer "is this the software we installed", so status now says so through `baseline_executable_unavailable` instead of skipping the question and returning current anyway. This makes the five missing baselines visible rather than silently trusted -- populating them is vendor-observation work. Reviewer finding RVR-P2-007. status still never executes the binary. Claude-Session: https://claude.ai/code/session_017fG88hR3mfP7YMFABzbKPB --- cli-tools/nddev_mimocode.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/cli-tools/nddev_mimocode.py b/cli-tools/nddev_mimocode.py index e3b0501..3e685b3 100755 --- a/cli-tools/nddev_mimocode.py +++ b/cli-tools/nddev_mimocode.py @@ -5586,7 +5586,14 @@ def software_status(target: Path, *, include_cleanup: bool = True) -> dict[str, drift.append("asset_sha256") if info.get("asset_size") != expected_size: drift.append("asset_size") + # The extracted-binary identity is the only check that survives an attacker + # who rewrites the manifest, because the manifest sits beside the binary and + # is equally writable. A baseline that omits it therefore cannot answer + # "is this the software we installed" at all -- so say so instead of + # skipping the check and still reporting current. executable_baseline = asset.get("executable") + if not isinstance(executable_baseline, dict): + drift.append("baseline_executable_unavailable") if isinstance(executable_baseline, dict): for key in ( "archive_member_path",