fix(store): address 5 security findings from jaylfc review of #1924 - #2023

Merged

jaylfc merged 13 commits into

hognek:fix/jaylfc-security-1924

Jul 19, 2026

Commits on Jul 17, 2026

feat(store): add Ed25519 manifest signing and verification for install-v2
hognek
committed
5ec192d
fix(store): address Kilo bot review (round 2)
hognek
committed
ac135b6

Commits on Jul 18, 2026

fix(store): resolve Ed25519 signing review issues (Kilo CRITICAL + nits)
hognek
committed
18524fd
fix(store): unique retry tmp path in signing keypair creation + remove redundant os import
hognek
committed
147d6be
fix(store): address 5 security findings from jaylfc review of #1924
hognek
committed
52fc402
fix(store): resolve Kilo WARNING — remove tmp.unlink race in keygen recovery
hognek
committed
60eefc2
fix(security): address Kilo SUGGESTIONS — fail-closed verify_manifest_signature + second signature re-verify TOCTOU guard
hognek
committed
ba9e17f
fix(store): assert 422 instead of 500 for unknown backend install
hognek
committed
c15efd7
fix(security): address CodeRabbit findings — aliasing, permissions, race, snapshot, signing failures, 422 test
hognek
committed
6c3e651
fix(store): add TOCTOU re-verify guard for backend manifest and guard keyfile.stat() OSErrors
hognek
committed
4c669af
fix(store): remove redundant secondary TOCTOU re-verify for backend manifest
hognek
committed
0c73619

Commits on Jul 19, 2026