security inventory: OS and npm dependency acquisition remain network-bound #8

Status

PARTIALLY_REMEDIATED / NETWORK_BOUND_DEPENDENCY_ACQUISITION_REMAINS

Original finding

The Evaluation Kit previously executed configured verifier commands through unrestricted shell dispatch and installed npm dependencies with lifecycle-script exposure. Its container also acquires operating-system packages through apt-get.

Completed remediation in draft PR #13

Current exact draft head:

868341e2a26ae1ac912be170a2930034b06623ee

Implemented controls:

• verifier execution is constrained by the single sourced command-policy.sh allowlist;
• unsupported commands are tested through tests/command-policy-negative.sh;
• CI requires nonzero denial, the fail-closed reason, and denied-command identity;
• npm package lifecycle scripts are denied with --ignore-scripts;
• GitHub Actions uses ubuntu-24.04 and an exact checkout action commit;
• the Docker base is bound by tag and digest:

node:20.11.0-bookworm-slim@sha256:ecc9a2581f8588014a49a523a9ed146d27963f6d988d11bd16bbdcb3598f5f98

• CI fails closed unless the observed tag digest, environment-lock digest, and Dockerfile digest match;
• the public README and claim-ceiling.json preserve the remaining network and claim boundaries.

Exact-head execution evidence

GitHub Actions run 30286309516, job 90044856022, completed successfully for the exact draft head above.

Observed successful steps include:

• base-image identity observation;
• environment-lock and Dockerfile identity matching;
• required-file and registry validation;
• unsupported-command fail-closed testing;
• digest-pinned Docker build;
• full Evaluation Kit execution;
• verification success summary.

The bounded result is:

BASE_IMAGE_IDENTITY_LOCK_MATCH
ALLOWLIST_NEGATIVE_TEST_PASS
NPM_LIFECYCLE_SCRIPTS_DENIED
REPRODUCTION_MATCH

Remaining issue

Dependency acquisition still uses the network in two places:

1. the Docker build performs apt-get update and installs git, jq, and ca-certificates from configured Debian package repositories;
2. repository npm dependencies are acquired from the configured npm registry during evaluation.

The current profile therefore does not support claims of:

• offline reproduction;
• hermetic operating-system package resolution;
• hermetic npm dependency resolution;
• vendored dependency completeness;
• fully preserved package-repository state;
• full supply-chain isolation.

Future closure paths

Close this remaining inventory item only through one of:

1. an adopted offline or frozen dependency profile with exact OS-package and npm-package identities, preserved acquisition sources, and successful execution evidence; or
2. an explicit authority disposition accepting network-bound acquisition for the bounded profile while preserving the non-hermetic claim ceiling, review triggers, and acquisition risks.

Boundary

This issue does not claim compromise, production readiness, complete security hardening, external audit, independent reproduction, complete supply-chain isolation, or absence of defects.

It does not authorize registry pin changes, releases, tags, or broader F0–F4 claims.