Authenticate store permission classes - #53
Merged
Conversation
Store identity now distinguishes the read, execute, and special permission classes that survive admission, so packages with materially different runtime access cannot share a store path. Write bits, ownership, and other environment-dependent metadata remain outside identity. Manifest v5 selects the additive v4 identity while every prior manifest and hash format keeps its original meaning. Archive extraction now preserves ordinary directory permissions so packaged intent and verified realized state remain identical.
The specification now records every store-hash domain prefix and clarifies the directory record shape, so independent implementations can reproduce v4 without inferring protocol bytes from source. It also identifies both manifest formats that use the domain-separated signature envelope.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Store identity v3 collapses materially different runtime permissions: modes such as
0600and0644, or0700and0755, can identify the same content. Because manifest v4 signs that v3 hash and full verification recomputes it, those access-class differences are neither authenticated nor detected. Review should establish a new identity contract without changing the meaning of any artifact Mere already reads.Store identity v4 prefixes
mere-store-content-v4\0and records a little-endianu16canonical mode ofmode & 07555for files and directories. This authenticates user, group, and other read/execute classes plus setuid, setgid, and sticky bits. Write bits remain normalized away because admission removes them; ownership, timestamps, ACLs, xattrs, and symlink modes remain outside identity.New packages use manifest v5, which selects store hash v4 and retains the domain-separated signature envelope. Manifest v1 through v4 and store hash v1, transitional, v2, and v3 keep their frozen readers and meanings. Older Mere versions are intentionally unable to consume manifest-v5 packages.
Packaging, import, installation, activation, and both full-verification paths share an explicit manifest-to-hash mapping. Newest-first manifest detection has one owner, and v5 cannot be interpreted with v3 hashing.
Archive round-trip coverage exposed that staged extraction recreated directories with default permissions. The merge now restores ordinary directory modes through no-follow handles while preserving the existing separate policy for special bits, so the mode hashed before packaging is the mode verified after extraction.