SecOps Codemark / Evidências

CodeMark 0.3.0 source and security review

Date: 2026-10-16 UTC. Reviewed runtime source: d5b0d57e0a29d998d5d9c2b5514952b97eae075c.

Scope and outcome

The review covered source preservation, manifest integrity, GPG/OpenSSH key pinning, CLI report transactions, resource bounds, portable packaging and release content selection. A separate reviewer inspected the functional changes and independently ran all 81 tests, with zero failures, errors or skips. The reviewed Python and packaging changes were approved with no blocking findings in that scope.

This is a focused internal release review. Its evidence consists of source inspection, regressions and local synthetic fixtures. It does not certify legal ownership, all supported source-language parsers, Windows, GUI rendering, hostile concurrent modification, or recovery after power loss. Website and deployment checks have their own release records.

Corrections verified

Source freshness before GPG signing

The previous GPG path could sign a valid manifest after a source file had changed. It now verifies the current tree under the project lock and checks that the prepared manifest matches the verified digest. A real GPG regression confirms that a stale tree is refused before a signature is published.

Comment prologues preserve program data

A second-line encoding directive inside a Python multiline string could cause a mark to be inserted into that string. An analogous CSS case could place a nested comment marker into an existing comment. Header scanning now stops at code, strings and unterminated block comments. Regression tests check Python runtime output, CSS comment preservation and byte-exact removal. Each regression failed against the previous implementation and passed after the correction.

Publication inputs stay bounded

The source builder rejects symlinks before emitting a portable executable, excludes local execution material, and produces an explicit source staging tree and SHA-256 manifest. Regressions check that a symlink cannot leave a portable containing external bytes and that local execution files are excluded. The portable package is built twice, compared byte for byte, then exercised outside the checkout.

Validation and remaining limits

The complete log is 0.3.0-tests.txt. Qualification metadata is 0.3.0-validation.json. Tests ran in isolated user, mount, network and PID namespaces, with read-only source/toolchains, a clean environment, bounded resources and temporary fixture keys. GPG, OpenSSH, Python, Node and Guile were exercised locally. No user keys or unrelated sources were used.

Marks can be removed or forged. A local unsigned manifest can be replaced. Authenticity requires a trusted public key and independently pinned fingerprint. Similarity remains heuristic. Locks and symlink checks support normal local use; they do not establish safety against a process actively replacing paths during an operation. Maintain a clean version-control checkpoint before applying marks.

Português brasileiro

A revisão focal da versão 0.3.0 cobriu preservação dos fontes, integridade do manifesto, pinagem de chaves GPG/OpenSSH, relatórios da CLI, limites de recursos e empacotamento. Um revisor separado examinou as alterações e executou novamente os 81 testes, sem falhas, erros ou testes ignorados. Não foram identificados bloqueadores nesse escopo.

Foram corrigidos a assinatura GPG de uma árvore divergente e a inserção de marcas em strings Python ou comentários CSS que pareciam diretivas de cabeçalho. Os testes de regressão reproduziram os problemas antes das correções e verificaram preservação do comportamento e remoção byte a byte depois delas. O empacotamento também recusa links simbólicos antes de produzir o executável e exclui material local de execução.

Esta é uma revisão interna com fontes e fixtures locais. Windows, renderização da GUI, modificações concorrentes hostis, falhas de energia e validação exaustiva dos parsers de cada linguagem exigem avaliação própria. Marcas, similaridade e assinaturas não provam titularidade legal ou data de criação. Use uma chave pública confiável, fixe o fingerprint por canal independente e preserve um estado limpo no controle de versão antes de aplicar marcas.