[Docs] Publish how to verify the vendored JavaScript against upstream #641

New issue

Closed

opened 2026-07-22 16:23:38 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 16:23:38 +00:00

Owner

Found in the pre-publication security review.

Evidence: tool/check_bundled_js.dart:10-18 compares each file against the sha256 in assets/web_export/MANIFEST.json — both in the same repository, so anyone changing one changes the other. What the manifest does carry is a source: per bundle, and that route holds: I fetched dompurify@3.4.12 and marked@18.0.5 from jsdelivr and both hash exactly to the manifest values, and to the files on disk. But nowhere in docs/ is it stated that this property holds, or how to check it.

Why this matters: "why should I believe you have not touched 3.5 MB of minified mermaid?" is the first question a reviewer asks about an export that delivers 5.8 MB of third-party JavaScript to a client. The answer is strong — byte-identical to upstream, verifiable in one command — but it is not written down, and an unanswered question counts as a gap.

Proposal: three lines in docs/SBOM.md or THIRD_PARTY_NOTICES.md: each bundle is an unmodified upstream build; verify with curl -sL <source> | shasum -a 256 and compare against sha256 in MANIFEST.json. Optionally a --verify-upstream flag in tool/check_bundled_js.dart that does this for all six.

Found in the pre-publication security review. **Evidence:** `tool/check_bundled_js.dart:10-18` compares each file against the sha256 in `assets/web_export/MANIFEST.json` — both in the same repository, so anyone changing one changes the other. What the manifest *does* carry is a `source:` per bundle, and that route holds: I fetched `dompurify@3.4.12` and `marked@18.0.5` from jsdelivr and both hash exactly to the manifest values, and to the files on disk. But nowhere in `docs/` is it stated that this property holds, or how to check it. **Why this matters:** "why should I believe you have not touched 3.5 MB of minified mermaid?" is the first question a reviewer asks about an export that delivers 5.8 MB of third-party JavaScript to a client. The answer is strong — byte-identical to upstream, verifiable in one command — but it is not written down, and an unanswered question counts as a gap. **Proposal:** three lines in `docs/SBOM.md` or `THIRD_PARTY_NOTICES.md`: each bundle is an unmodified upstream build; verify with `curl -sL <source> | shasum -a 256` and compare against `sha256` in MANIFEST.json. Optionally a `--verify-upstream` flag in `tool/check_bundled_js.dart` that does this for all six.

brenno added the

security

docs

labels

2026-07-22 16:23:38 +00:00

brenno referenced this issue from a commit

2026-07-22 17:16:49 +00:00

feat(deps): maak aantoonbaar dat de gebundelde JavaScript onaangeraakt is

brenno referenced this issue from a pull request that will close it,

2026-07-22 17:16:51 +00:00

feat(deps): maak aantoonbaar dat de gebundelde JavaScript onaangeraakt is (#641) #657

brenno closed this issue