fix(security): mandatory / fail-closed cosign verification in the CLI installer (RFC-0001 R8)

[saadqbal]

Security-sensitive — DRAFT for human review. Part of RFC-0001 R8 (Phase-1 blocking security must-have), tracked as tracebloc/backend#889. Cross-repo companion PR lands in tracebloc/client (the curl|bash bootstrap).

The gap

scripts/install.sh verified SHA256, then verified the cosign signature only if cosign was on PATH — and silently skipped it otherwise (the default on a fresh box), printing (cosign not installed; SHA256 verified, signature skipped). SHA256SUMS is fetched over the same channel as the binary, so an on-path attacker who swaps the binary can swap the sums too. The signature was the only independent proof, and it was optional.

The fix

Signature verification is now mandatory on the default path:

• if cosign isn't installed, bootstrap a pinned (v2.4.1), checksum-verified cosign and use it;
• fail closed if cosign can be neither found nor bootstrapped, or if .sig/.cert aren't published — never fall back to the same-channel SHA256 alone, never print the old "signature skipped" line;
• keep the SHA256 gate as the first layer;
• one explicit, loud escape hatch for constrained environments: TRACEBLOC_ALLOW_UNVERIFIED=1.

Stays POSIX sh (verified with dash -n + shellcheck --shell=sh).

Tests / CI

• New scripts/tests/install-verify.sh — a network-free harness (mocked curl/cosign, host cosign hidden via PATH) asserting: valid-sig installs, bad-sig aborts, cosign-absent fails closed, the signature skipped string is gone, opt-in degrades with a warning, SHA256 mismatch aborts. 6/6 pass locally.
• New installer job in build.yml runs shellcheck + dash -n + the harness (the installer had no automated test before).

Decisions / open questions

• cosign keyless (not minisign/gpg): no new signing secret; the binary release already uses it. See the client PR's docs/SUPPLY_CHAIN.md §3.
• 386 / arm without cosign installed can't bootstrap (no official cosign build for those arches) → they fail closed, or pre-install cosign. Documented in the README note. Acceptable: fail-closed is the point.
• The cosign-bootstrap trust root is TLS-to-GitHub + cosign's own checksums (you can't verify cosign's signature without cosign). Strictly better than the status quo; the stronger path (pre-install cosign / internal mirror) is documented.

Not verified

I could not run the installer end-to-end against a real GitHub release from this environment (no network to releases), so the happy path is exercised only via the mocked harness, not a live download.

🤖 Generated with Claude Code

---

Note

High Risk
Changes the default supply-chain trust model for the privileged curl|sh installer; regressions could block installs or weaken verification, though behavior is covered by the new harness and static checks.

Overview
scripts/install.sh no longer treats cosign as optional. After SHA256, signature verification is required: use cosign on PATH, or bootstrap pinned v2.4.1 with TLS 1.2 fetches and checksum verification against Sigstore’s published sums. If verification can’t run (no cosign/bootstrap, missing .sig/.cert, or failed verify-blob), the install exits instead of printing “signature skipped.” TRACEBLOC_ALLOW_UNVERIFIED=1 is the only downgrade and emits explicit warnings.

validate_tag runs on the resolved release tag before downloads, blocking /, .., and non-vX.Y.Z shapes so --version can’t be used for path traversal in release URLs.

CI and docs: a new installer job runs shellcheck, dash -n, and scripts/tests/install-verify.sh (mocked curl/cosign, no network). README documents mandatory verification and the opt-out env var.

^{Reviewed by Cursor Bugbot for commit f0c5a6f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saadqbal]

Independent security review — should-fix

Confirmed the mandatory / fail-closed cosign property holds — the old "signature skipped" branch is gone and the fail-closed paths verified (harness 6/6).

• 🟠 Should-fix — resolve_tag (scripts/install.sh ~L188-190) returns --version/RELEASE_VERSION verbatim into BASE_URL=.../releases/download/${TAG}. Lower impact than the client case (the binary still must pass SHA256 and the pinned-identity cosign verify → fails closed), but validate TAG against ^v[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9.]+)?$ + reject */*/*..*.
• 🟡 Nit — the cosign-bootstrap curls miss the --tlsv1.2 floor the rest of the codebase uses; add for consistency.

Fixes are being applied to this branch now.

🤖 Reviewed by Claude Code