#199: SHA-256 integrity hashes for attachments #259

Merged

fable-5 merged 1 commits from feat/199-attachment-integrity-hashes into main 2026-07-31 04:51:49 +02:00

Conversation 0 Commits 1 Files Changed 9 +266 -6

fable-5 commented 2026-07-31 04:32:42 +02:00

Collaborator

Copy Link

Stacked on #258 (#202) -> #257 (#236). Issue #199.

• attachments.sha256 (nullable) added by migration; upload computes the hash from the in-memory buffer being written (never re-reads disk).
• Download reads and re-hashes the whole object BEFORE serving a byte (a stream cannot be un-sent; memory bounded by the max_file_bytes quota) and fails closed with attachment_integrity_failure (HTTP 500); the mismatch is audited as file.integrity_failed with both hashes. Null-hash rows (pre-backfill) are served unverified — the pre-#199 status quo.
• Backfill rides the existing nightly orphan-file-sweep job (bounded batch, idempotent, no new scheduler job — job-count fence untouched); unreadable files are logged and retried, never silently skipped.
• Tests (attachment-integrity.e2e.db.test.ts): upload stores the correct hash; on-disk tamper makes download fail closed with the code + audit row; backfill restores hashes, keeps unreadable rows null, and is idempotent. Full api suite green (476) against a fresh DB; migrate deploy verified on a second fresh DB.
• Docs: security.md (behaviour + operator response), operations.md (backfill rider); plan checkbox. #229 note follows after merge.

Stacked on #258 (#202) -> #257 (#236). Issue #199. - `attachments.sha256` (nullable) added by migration; upload computes the hash from the in-memory buffer being written (never re-reads disk). - Download reads and re-hashes the whole object BEFORE serving a byte (a stream cannot be un-sent; memory bounded by the max_file_bytes quota) and fails closed with `attachment_integrity_failure` (HTTP 500); the mismatch is audited as `file.integrity_failed` with both hashes. Null-hash rows (pre-backfill) are served unverified — the pre-#199 status quo. - Backfill rides the existing nightly orphan-file-sweep job (bounded batch, idempotent, no new scheduler job — job-count fence untouched); unreadable files are logged and retried, never silently skipped. - Tests (`attachment-integrity.e2e.db.test.ts`): upload stores the correct hash; on-disk tamper makes download fail closed with the code + audit row; backfill restores hashes, keeps unreadable rows null, and is idempotent. Full api suite green (476) against a fresh DB; `migrate deploy` verified on a second fresh DB. - Docs: security.md (behaviour + operator response), operations.md (backfill rider); plan checkbox. #229 note follows after merge.

fable-5 added 4 commits 2026-07-31 04:32:42 +02:00

#236: pin the Node version ... 6a520e27b1

.node-version (22.15.1) becomes the single authoritative Node version:
CI/CD select Node only via node-version-file, every Dockerfile pins
node:22.15.1-alpine, and the engines floor in package.json states the
same version (open-ended upwards so a newer local Node keeps working —
reproducibility rests on images and CI). An early CI step fails on any
drift between those places; update procedure in operations.md
(Update strategy). Precondition for the reproducibility claim in #219.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#236: also pin the node helper images in workflows ... 9326177534

release.yml and drill.yml ran throwaway `docker run node:22.15-alpine`
helpers outside the pin; the drift check now also fails on any
node:<other>-alpine reference in .gitea/workflows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#202: SBOM and license report in CI ... d3289b2167

The release run now generates CycloneDX 1.6 SBOMs with a pinned
anchore/syft container — one per released image (scanned from the
freshly built image tar, OS packages included) and one for the pnpm
workspace (from the lockfile) — plus the full pnpm licenses report, and
attaches everything as build artefacts BEFORE publishing the release,
so a red gate stops the release. Runner constraints dictated the
mechanics (documented in the workflow): the job talks to the HOST
daemon, so files travel into the syft container via docker cp and
images via docker save to a tar copied the same way (syft cannot read
a tar from stdin — verified).

scripts/check-licenses.mjs is the documented license policy: permissive
allowlist, MPL-2.0/CC-BY-4.0 with recorded reasoning, per-package
exception table (khroma: MIT text shipped, metadata missing). CI runs
the gate on every PR (pnpm licenses:check); positive and negative case
tested locally, both SBOM paths tested against real images/lockfile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#199: SHA-256 integrity hashes for attachments ... 74970f6073

Every upload stores the SHA-256 of its bytes, computed from the
in-memory buffer that is written — never by re-reading disk. Every
download re-hashes the stored object BEFORE the first byte leaves
(memory bounded by the max_file_bytes quota that gated the upload) and
fails closed on mismatch with attachment_integrity_failure; the
mismatch lands in the audit trail as file.integrity_failed with both
hashes. Detection of payload manipulation is the one integrity duty
par. 52 VSA leaves with the application — only it knows what the file
should be.

Pre-#199 rows are hashed by a bounded, idempotent backfill that rides
the existing nightly orphan-file-sweep job (no new scheduler job, job
fence untouched); unreadable files are logged and retried, never
silently skipped, and null-hash rows are served unverified only until
the backfill reaches them. Operator runbook note in security.md
(restore from backup, re-download, audit entry carries both hashes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 referenced this pull request 2026-07-31 04:42:59 +02:00

#200: hard instance-wide plugins.enabled kill switch #260

fable-5 referenced this pull request 2026-07-31 04:51:21 +02:00

#201: stable audit event catalogue for syslog/SIEM export #261

fable-5 merged commit 74970f6073 into main 2026-07-31 04:51:49 +02:00

fable-5 referenced this pull request 2026-07-31 04:52:11 +02:00

[VS-NfD] Add SHA-256 integrity hashes for attachments #199

fable-5 referenced this pull request 2026-07-31 04:52:27 +02:00

[VS-NfD] Write the operations manual (installation, update, backup/restore, deletion, role separation) #229

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

  

area:docs

  

area:export

  

area:ops

  

area:storage

  

area:supply-chain

  

auth

Authentication, permissions, quotas

  

backend

API server (apps/api)

  

blocked

Blocked on external dependency/infrastructure

  

collab

Collaboration server (apps/collab)

  

deployment

Docker, CI/CD, hosting

  

docs

Documentation

  

effort:L

  

effort:M

  

effort:S

  

frontend

SPA (apps/web)

  

plugins

Plugin system and SDK

  

qa

Tests, fixtures, e2e

  

vs-nfd

  

vs-nfd:blocker

No Label

area:auth

area:docs

area:export

area:ops

area:storage

area:supply-chain

auth

backend

blocked

collab

deployment

docs

effort:L

effort:M

effort:S

frontend

plugins

qa

vs-nfd

vs-nfd:blocker

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#259

No description provided.