release: v0.9.1 — close two #135-class keyless verify bypasses + STPA-Sec report

[avrabe]

Summary

Closes #135. This branch was started as the artifact-binding fix for the original bug (one byte flipped in a signed module returned exit 0 from wsc verify --keyless). Once that landed, an STPA-Sec pass on the keyless verify subsystem found a second #135-class bypass at the next layer up — the embedded Rekor entry was never cross-referenced against the bundle, so any unrelated public Rekor entry would pass.

Both fixes ship in this release. The STPA report is also included so the maintainer has a durable reference for the three other open UCAs that didn't land here.

Two security fixes (both #135-class)

Fix 1 — Artifact binding (initial commit on this branch)

KeylessVerifier::verify verified the Fulcio cert chain + Rekor SET, then accepted the module without recomputing its hash or ECDSA-verifying the signature against the leaf cert. New KeylessSignature::verify_artifact_binding strips the signature section, recomputes SHA-256, and verify_digests the signature under the leaf cert's SPKI. Wired as step 4 of verify().

Fix 2 — Rekor body binding / UCA-2 (second commit on this branch)

After fix 1, the verifier proved (cert+sig+module) were mutually consistent and (Rekor entry was logged by Rekor), but never decoded the entry's body to check that the logged (hash, signature, public key) triple actually referenced this bundle. An attacker holding any legitimate Fulcio cert could sign a malicious module and embed any unrelated public Rekor entry to pass verification:

1. Attacker obtains a legitimate Fulcio cert for their own OIDC identity (any signed-in user can).
2. Signs malicious module M' with their ephemeral key.
3. Constructs a KeylessSignature with their genuine sig + cert + SHA256(M'), embedding any unrelated public Rekor entry.
4. wsc verify --keyless returns exit 0.

The original #135 attack class re-emerges one layer up.

New KeylessSignature::verify_rekor_body_binds_to_bundle decodes the hashedrekord/0.0.1 body and asserts three equalities: artifact hash, signature content, and leaf-cert DER. Wired as step 5 of verify().

Tests

17 new tamper-rejection unit tests in src/lib/src/signature/keyless/format.rs, all passing. Coverage matrix:

Fix 1 (artifact binding)	Fix 2 (Rekor body binding)
accept genuine signed module	accept consistent body
reject byte-flipped module	reject artifact-hash mismatch
reject corrupted signature blob	reject signature-content mismatch
reject substituted module_hash field	reject public-key mismatch
reject substituted leaf cert	reject unsupported kind
reject module without signature section	reject unsupported apiVersion
reject empty cert chain	reject non-sha256 hash algorithm
	reject garbage / non-base64 body
	reject non-JSON body
	accept uppercase hex-hash (Rekor sometimes returns these)

Full cargo test -p wsc: 620 tests pass (605 lib + 5 + 5 + 5), 0 failures.

Error variant design note

Both checks return WSError::VerificationFailed with a log::error! identifying the specific mismatch. The error variant is deliberately not discriminated (no HashMismatch / SignatureInvalid / BodyHashMismatch variants) — that would give an attacker an oracle to discover which leg of the check rejected their forgery while iterating. Operators get the detail via the log line.

STPA-Sec report (new)

docs/security/stpa-keyless-2026-05-25.md — five UCAs identified, all independently verified against HEAD. Each UCA has a code citation, STPA-4 questions, loss scenario, suggested fix, and a verification trail (grep commands + file:line that confirmed the gap):

UCA	Severity	Status	Issue
UCA-1: Rekor inclusion proof never run on verify path	High	open	(file as follow-up)
UCA-2: Rekor body never cross-checked with bundle	Critical	closed by this PR	—
UCA-3: Cert validity bound to attacker-pickable integrated_time	High (conditional)	open	(file as follow-up)
UCA-4: Cache hit skips SET re-verify with no bundle-equality check	Medium (conditional)	open	(file as follow-up)
UCA-5: Audit log records hash from silently-discarded serialize error	Low	open	(file as follow-up)

Plus 4 speculative items the STPA explicitly couldn't confirm (multi-SAN selection, serialize determinism, two-signature-section asymmetry, Module::Clone completeness), 1 out-of-scope flag (sct.rs SCT verifier stub never invoked — Fulcio SCTs entirely unchecked, separate subsystem), and 7 properties explicitly cleared (skip-Rekor sentinel, chain depth bound, empty cert chain handling, negative-time rejection, etc.).

Version + release

This PR bumps the workspace version 0.9.0 → 0.9.1 (patch release for security fixes). CHANGELOG [0.9.1] — 2026-05-25 entry written. Once this merges, tag v0.9.1 will trigger the release workflow.

Downstream impact

pulseengine/synth #140 case 3 currently xfails wsc verify --keyless on a byte-flipped module. After this release ships, that assertion can flip back to "tampered file rejected" with no synth-side changes. (Note: synth would need a separate test for the UCA-2 attack — synth #140 case 3 only exercises Fix 1's behaviour.)

Disclosure

Both UCAs are verification-bypasses in the load-bearing keyless path. Affected versions: all releases that included KeylessVerifier::verify (back through v0.9.0 and earlier). Recommend GHSA + RUSTSEC advisory + yank of affected versions; flagging here rather than asserting.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 83.75286% with 71 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/lib/src/signature/keyless/format.rs	84.91%	65 Missing ⚠️
src/lib/src/signature/keyless/signer.rs	0.00%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!