Historical · 2026-10-16
This report applies to its stated historical version and scope. It is preserved as evidence and does not qualify changed source in a later release.
Download reportSecOps Codemark 0.4.0 focused source review
Date: 2026-10-16 UTC. Runtime revision: e3a75b894af22be377a3b52c2b2f540bc11011b0.
Scope and method
Reviewed file inventory, attestation validation and persistence, native OpenSSL invocation, encrypted archive publication, CLI report handling, packaging and their regression tests. Implementation and separate source review were followed by concrete reproductions of the identified defects. This is a focused source review with local test evidence, not an independent external security audit, penetration test or certification.
Trust boundaries
- Project paths, files, metadata and public keys are untrusted inputs. Full snapshots bound and validate paths, JSON schemas, counts, byte sizes and source stability.
- The operating system, selected native executables and verifier are trusted. This tool does not contain a compromised host or prevent privileged changes.
- Whole-file authentication requires both independently trusted public-key fingerprints. Embedded keys alone are insufficient.
- A separately retained expected latest checkpoint is necessary for detecting a valid older history. Local timestamps are untrusted.
- Private signing keys and passphrase files must be outside the project. Native OpenSSL reads private material; the Python signing backend does not copy key contents into reports.
- Private bundles pin an external public recipient key and include regular files in VCS and
.codemarkdirectories. Users must inspect the chosen tree; no content-based secret exclusion is claimed.
Findings corrected and exercised
| Finding | Correction and evidence |
|---|---|
| Integrity limited to source comments | Separate streamed SHA-256/SHA-512 inventory covers regular files regardless of extension, including JSON, documents, binaries and ISO fixtures |
| Mutable or ambiguous metadata | Exact schemas, duplicate-field and nonfinite-number rejection, bounded parsing, strict paths, independent signer pins and both mathematical signatures |
| Historical reference substitution | Signed raw-manifest digests, linked record sequence and optional external SHA-512 checkpoint |
| Concurrent history append overwritten | Freeze original history bytes and refuse publication when another history appears or changes; valid concurrent append regression passes |
| Metadata regular-file to FIFO race | Nonblocking open, final-component no-follow where available and descriptor regular-file checks; a real FIFO swap regression completes without hanging |
| Windows stat/fstat identity or ctime mismatch | Fresh no-follow path metadata and separate full path/descriptor stability checks; full POSIX directory ctime guard retained |
| Windows reparse paths followed | Reject reparse attributes in roots, ancestors, metadata and full inventories; regression cases exercise the attribute checks |
| Native archive or source changes during export | Pre/post streamed inventories, key and executable identities, binary encryption-mode inspection, exclusive output linking and owned temporary cleanup |
| Report failure after an intended mutation | Reserve a new external report, flush it before committing and preserve prior project state when reporting fails |
| Permissive report permissions | New report files explicitly request mode 0600; regression passes with process umask 000 on POSIX. Windows ACL policy remains an operating-system responsibility |
Verification
The qualified GNU/Linux run passed 175 tests, with zero skipped or failed, in 7.011 seconds. It used real ephemeral ML-DSA-87, Ed25519, GPG, SSH and native Zupt fixtures. Ruff, formatting, Pyright and the bounded selected-source secret scan passed. The portable passed 11 smoke checks from outside the source tree with isolated Python. Read the linked qualification, full log and portable records for exact scope.
Remaining limits
Hashes and signatures detect divergence from a reference; they do not establish that the reference is free of vulnerabilities. Source comments remain removable. Similarity is heuristic evidence, not proof of plagiarism or legal ownership. The hybrid signature format is application-specific and is not a FIPS 140 certified module or a trusted timestamp service.
Snapshot exclusions are explicit VCS and .codemark directories. Private bundles include those directories and require native Zupt 5.2.10+. Their ciphertext header is checked at creation; end-to-end decryption verification requires the recipient's private key and is not claimed by the bundle command. Automated tests perform that round trip with disposable keys. Zupt 5.2.10 does not restore POSIX modes or ACLs; extraction uses the current umask. Restored bytes can match while the signed audit reports mode_changed; restore independently trusted permissions before treating that audit as passing.
The GUI handles legacy source-comment operations. Windows runtime gates and native optional-tool availability are recorded separately. Large-file limits are tested through bounded fixtures and patched limits, not a measured 100 GiB throughput qualification.