NFR-16: checksum the wasm-bindgen download, pin the rustup installer, hash-lock non-wasm vodozemac outputs #164
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Review finding 2026-08-27 (D10).
build.yml:47-55curls the wasm-bindgen CLI by version with no checksum and installs rustup viacurl | sh; only the wasm driver binary has a lock (wasm-lock.json); JVM/Android/Apple vodozemac outputs are rebuilt per run with no recorded hash or signature.verification-metadata.xmltrusts everything except the two native groups.Acceptance (§9, NFR-16): checksummed downloads, a lock file per native output like the wasm one (or a D-entry recording why reproducible rebuild suffices), verification scope decision recorded.