Add threat model; make .npmrc rewrites atomic#15
Merged
jgowdy-godaddy merged 2 commits intomainfrom Apr 17, 2026
Merged
Conversation
This repo previously shipped only DESIGN.md — no dedicated threat model and no security policy. Add THREAT_MODEL.md that names what npmenc does and doesn't protect against under Type 2 (EnvInterpolation) delivery, with explicit focus on: - The defining residual risk: every npm install runs arbitrary JS from transitive dependency lifecycle scripts with NPM_TOKEN_* in the environment. This is the single biggest threat specific to npm as a Type 2 target and cannot be mitigated inside npmenc. - Same-UID /proc/<npm-pid>/environ readability for npm's full lifetime. - npmenc-specific concerns: rollback via VCS-stored plaintext .npmrc, atomic rewrites, concurrent npm vs. npmenc, HTTPS-only registry URL reconstruction, over-injection of NPM_TOKEN_* on subcommands that don't need it, token-source timeout, <redacted> sentinel, program resolution, macOS .handle plaintext, multi-user systems, WSL bridge. Add SECURITY.md with the usual reporting-vulnerabilities boilerplate plus a summary of guarantees and limitations, mirroring the sister projects' style. Make .npmrc rewrites atomic. The five fs::write call sites in install.rs and uninstall.rs are replaced with a new npmenc-core::atomic_write::atomic_write_preserving_mode that writes to a sibling temp file and renames over the target, preserving the original file's Unix mode bits. Power loss / crash mid-rewrite now leaves either the pre-install or post-install contents, never a partial mix. 4 unit tests added for the atomic-write helper; existing install / uninstall tests continue to pass. No public API changes.
The module-level `use std::fs;` was flagged as unused on Windows by `-D warnings` because both `fs::metadata` and `fs::set_permissions` live inside `#[cfg(unix)]` blocks. Switch those two call sites to fully-qualified `std::fs::...` paths and move the `use std::fs;` into the tests module where it's consumed on all platforms by `fs::write` / `fs::read` helpers.
jgowdy-godaddy
pushed a commit
that referenced
this pull request
Apr 17, 2026
- Drop the stale "Planned Future Extraction" section: enclaveapp-app-adapter was incubated here and has since been promoted into libenclaveapp. - Overview and Workspace Layout no longer list the adapter as a local crate. - Document atomic .npmrc rewrites via atomic_write_preserving_mode (PR #15). - Document the --publish-only wrapper flag and its subcommand classification helpers in cli_common (PR #17).
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This repo previously shipped only DESIGN.md — no `THREAT_MODEL.md` and no `SECURITY.md`. This PR closes that gap and fixes a latent bug uncovered during the audit.
New docs
Latent bug fix: atomic `.npmrc` rewrite
Five `fs::write` call sites in `install.rs` and `uninstall.rs` rewrote `.npmrc` non-atomically. A power loss or crash mid-write could leave a half-stripped file — the plaintext prefix truncated away but the managed placeholder not yet written. Replace with `npmenc-core::atomic_write::atomic_write_preserving_mode`, which writes to a sibling temp file and renames over the target, preserving the original file's Unix mode bits.
Test plan