Development record
abcd ahoy install promotes an owned copy of the abcd binary (internal/core/ahoy/owned_copy.go) after checking it only against checksums.txt from the same release page, the weakness iss-2609231050273096 fixed for abcd update: whoever can change the release page can swap the binary and its checksum together. Found by the E5 fix lane on 2026-10-12.
issueresolvedmajoriss-2610120617515834
abcd ahoy install promotes an owned copy of the abcd binary (internal/core/ahoy/owned_copy.go) after checking it only against checksums.txt from the same release page, the weakness iss-2609231050273096 fixed for abcd update: whoever can change the release page can swap the binary and its checksum together. Found by the E5 fix lane on 2026-10-12.
Frontmatter
| id | iss-2610120617515834 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-2610120617515834-ahoy-install-trusts-same-page-checksum.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609231050273096abcd update verifies a downloaded binary only against the checksums.txt published in the same GitHub release (internal/core/update/update.go), so it catches corruption in transit but not a release page whose binary and checksums.txt were both replaced; the binary needs an independent check next cycle, such as a digest committed in the repository's history the way the plugin catalog now pins the plugin archive (adr-2609231048308186), or verification of the release's signed build-provenance attestation (a new verification dependency needs sign-off first). Ruled by the product thinker on 2026-09-23 (E5, 10:27Z): harden next cycle; this release keeps the same-page check.