Postulo/postulo-firefox
Postulo/postulo-firefox
Watch
1
0
Fork
You've already forked postulo-firefox
 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

Fix the open security issues: web-ext 10, safer workflows and pin, move the pin to chromium a1967a610 #12

Merged
tiagoagueda merged 4 commits from sec2-fixes into main 2026-10-19 09:53:47 +00:00
Conversation 0 Commits 4 Files changed 11 +963 -821
tiagoagueda commented 2026-10-19 07:05:30 +00:00
Owner

What and why

#9 (SEC2-052) dev chain. web-ext 8.10.0 -> 10.8.0 and npm audit fix. 15 advisories (3 critical) become 1: node-forge (high, GHSA-86w9-cpqp-85rv), which has no fixed release (1.4.0 is the latest) and is reached only through web-ext's Android bridge (@devicefarmer/adbkit), which lint, build and sign never run. scripts/audit.mjs (the same script postulo-chromium runs since its PR #40) fails on any other high or critical advisory and names that one with a reason; both workflows run it after npm ci (npm run audit). Plain npm audit --audit-level=high would be red today for a finding nobody can fix, so the gate is the script, not that flag. Checked that it fails when the entry is removed.

#10 (SEC2-082) credentials and build target. Both workflows check out with persist-credentials: false. build.mjs and check-pin.mjs refuse any repository in source.json other than postulo-chromium's, before cloning (scripts/pin.mjs; POSTULO_PIN_ALLOW adds a repository for the tests only, nothing in the workflows sets it).

#11 (SEC2-083) tag as pin. The pin must be a 40-hex commit sha always; a tag name or short sha is refused (the message names the commit to pin); once postulo-chromium has tags the pin must equal the commit of the latest one (annotated tags peeled), the name only a hint. source.json note and README updated.

The pin moved

source.json ref: b6c1009f391357ed8cf9c9b8b2e4be47c27a0a8c -> a1967a61052d11996100acad860356b7abf6b419 (tip of postulo-chromium main). Between them, 4 commits: postulo-chromium PR #40 (1426d71, all its security-review and bug fixes: hardened src/lib/api.js, allow.js, known.js, outbox.js, parse.js, rendering.js, captures.js, popup.js, review.js, options.js, new English strings, PRIVACY.md, web-ext 10 and an audit step there) and two Weblate pt-PT updates (#31). The Firefox package now ships those fixes. Built with npm run build; web-ext lint: 0 errors, 0 warnings.

Tests

npm test: 7 pass (3 existing, 4 new: tag name refused once a tag exists, commit of the latest (annotated) tag accepted and an older one refused, branch and short sha refused, other repository refused by check and by build with nothing cloned). npm run check:pin, npm run audit, npm run lint pass. Not run here: the CI itself, and web-ext sign.

Closes #9, #10, #11

🤖 Generated with Claude Code

## What and why **#9 (SEC2-052) dev chain.** `web-ext` 8.10.0 -> 10.8.0 and `npm audit fix`. 15 advisories (3 critical) become 1: `node-forge` (high, GHSA-86w9-cpqp-85rv), which has **no fixed release** (1.4.0 is the latest) and is reached only through web-ext's Android bridge (`@devicefarmer/adbkit`), which lint, build and sign never run. `scripts/audit.mjs` (the same script postulo-chromium runs since its PR #40) fails on any other high or critical advisory and names that one with a reason; both workflows run it after `npm ci` (`npm run audit`). Plain `npm audit --audit-level=high` would be red today for a finding nobody can fix, so the gate is the script, not that flag. Checked that it fails when the entry is removed. **#10 (SEC2-082) credentials and build target.** Both workflows check out with `persist-credentials: false`. `build.mjs` and `check-pin.mjs` refuse any `repository` in `source.json` other than postulo-chromium's, before cloning (`scripts/pin.mjs`; `POSTULO_PIN_ALLOW` adds a repository for the tests only, nothing in the workflows sets it). **#11 (SEC2-083) tag as pin.** The pin must be a 40-hex commit sha always; a tag name or short sha is refused (the message names the commit to pin); once postulo-chromium has tags the pin must equal the commit of the latest one (annotated tags peeled), the name only a hint. `source.json` note and README updated. ## The pin moved `source.json` `ref`: `b6c1009f391357ed8cf9c9b8b2e4be47c27a0a8c` -> `a1967a61052d11996100acad860356b7abf6b419` (tip of postulo-chromium `main`). Between them, 4 commits: postulo-chromium PR #40 (`1426d71`, all its security-review and bug fixes: hardened `src/lib/api.js`, `allow.js`, `known.js`, `outbox.js`, `parse.js`, `rendering.js`, `captures.js`, `popup.js`, `review.js`, `options.js`, new English strings, PRIVACY.md, web-ext 10 and an audit step there) and two Weblate pt-PT updates (#31). The Firefox package now ships those fixes. Built with `npm run build`; `web-ext lint`: 0 errors, 0 warnings. ## Tests `npm test`: 7 pass (3 existing, 4 new: tag name refused once a tag exists, commit of the latest (annotated) tag accepted and an older one refused, branch and short sha refused, other repository refused by check and by build with nothing cloned). `npm run check:pin`, `npm run audit`, `npm run lint` pass. Not run here: the CI itself, and `web-ext sign`. Closes #9, #10, #11 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
web-ext 8.10.0 carried 15 advisories (3 critical). web-ext 10.8.0 and an
`npm audit fix` leave one: node-forge (high), which has no fixed release and
is reached only through web-ext's Android bridge (adbkit), never by lint,
build or sign. scripts/audit.mjs, the same script postulo-chromium runs, fails
on any other high or critical advisory and names that one with the day to look
again. Both workflows run it after `npm ci` and now check out with
`persist-credentials: false`, since everything after the checkout runs code
the pull request chooses.

Closes #9
Closes #10 (workflows half; the allow-list follows)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The build clones the repository source.json names and runs its
scripts/build.mjs, so a pull request editing one JSON line could run a
repository of its choosing in CI. build.mjs and check-pin.mjs now refuse any
repository but postulo-chromium's (scripts/pin.mjs; POSTULO_PIN_ALLOW adds to
the list for the tests only), before anything is cloned.

A tag can be deleted and made again on another commit, so the pin is a 40-hex
commit always: check-pin refuses a tag name or a short sha, and once
postulo-chromium has tags requires the commit the latest one points at
(annotated tags are peeled), printing the tag's name only as a hint.

Closes #10
Closes #11

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The pin was b6c1009f3. postulo-chromium PR #40 merged its security and bug
fixes (SEC2 review) as a1967a610; the Firefox package now ships them. The pin
check says a1967a610 is the tip of main; build, web-ext lint (0 errors, 0
warnings) and tests pass.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Describe the stricter pin and the audit in the README
All checks were successful
CI / build (pull_request) Successful in 17s
Details
70d0e04c3c
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something does not do what it says it does

  
documentation
The README, or the words a person reads

  
enhancement
An improvement or a new capability

  
security
Credentials, personal data, or what this may reach

No labels
bug
documentation
enhancement
security
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Postulo/postulo-firefox!12
No description provided.