fix(run-claude-cli): verify the installed CLI's npm signatures #792

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 19, 2026
2. kyle-sexton commented on Oct 20, 2026

   

   kyle-sexton

   on Oct 20, 2026

   MemberAuthor

   More actions

   Agent-ready brief (triaged 2026-10-20)

   • Decision: Verify the installed CLI two ways and fail closed on either. First, check the native binary's SHA256 against Anthropic's GPG-signed manifest.json. Second, run npm audit signatures on a saved install and fail unless its JSON output shows both packages audited. Keep the version pin from fix(run-claude-cli)!: run the subscription leg as its own job #803. Do not use --ignore-scripts. The issue body's "pinning is declined" premise is out of date: fix(run-claude-cli)!: run the subscription leg as its own job #803 pinned the CLI.

   • Current state (origin/main 834f4e1):

     • The CLI version defaults to 2.1.304 (run-claude-cli/action.yml:127-130, from #803).
     • A stale comment still calls latest the default (lane.cjs:256).
     • install() (lane.cjs:857-890) runs npm install --registry=${NPM_REGISTRY} --no-save --no-audit --no-fund --prefix <work>/cli @anthropic-ai/claude-code@<version>; --no-save is at :874 and the registry is https://registry.npmjs.org/ (:107). No signature or checksum check runs.
     • cli-path points at node_modules/.bin/claude (lane.cjs:888); the package's postinstall copies the platform binary into place, so --ignore-scripts leaves a stub that exits 1.
     • This work is in run-claude-cli, not in the intake-triage apply steps that PR #744 changes, so feat(intake-triage): record the proposed work class on every run #744 does not affect it.

   • Scope:

     • Manifest check: for the resolved version, download the release's manifest.json and its GPG signature, verify the signature against Anthropic's published key (pinned by fingerprint in the action), and compare the SHA256 recorded for linux-x64 with the SHA256 of the binary the install placed. Fail before any leg runs on a signature failure, a missing entry or a mismatch. Use the download location and key the setup docs name.
     • npm signatures: drop --no-save and install with --save-exact so the lockfile records the pinned version. Then run npm audit signatures --json --prefix <work>/cli --registry=${NPM_REGISTRY} (the same registry as the install). Fail unless the exit code is 0 and the JSON shows both @anthropic-ai/claude-code and the platform package (@anthropic-ai/claude-code-linux-x64) audited with verified signatures. A registry that publishes no keys is skipped with exit 0, so the exit code alone is not enough.
     • Keep the 2.1.304 pin and its vars.CLAUDE_LANE_CLI_VERSION override. Fix the stale lane.cjs:256 comment.
     • Keep scripts enabled. Check how npm 11.20+ and 12.1+ treat the postinstall under allowScripts (npm 11.19.0 warns that it is "not yet covered by allowScripts" but runs it). If a newer npm on the runner skips it, allow that one script explicitly; do not switch to --ignore-scripts.
     • Keep logging the resolved version.

   • Out of scope: returning to latest; npm provenance attestations (the package publishes none); pinning the tarball integrity hash; invoking the platform binary directly.

   • Acceptance criteria:

     • On a real install of the pinned version, the binary's SHA256 matches the linux-x64 entry in the GPG-verified manifest.json, and the launcher logs both values.
     • A test with a tampered binary, a bad manifest signature, or a manifest with no linux-x64 entry fails the launcher before any leg runs.
     • The install no longer passes --no-save, passes --save-exact, and the audit call passes the same --registry as the install (asserted in lane.test.cjs).
     • On a real install, npm audit signatures --json reports both @anthropic-ai/claude-code and @anthropic-ai/claude-code-linux-x64 verified.
     • A test whose stubbed audit JSON lists fewer than both packages, with exit 0, fails the launcher.
     • A test whose stubbed audit exits non-zero fails the launcher.
     • The install is not run with --ignore-scripts, and the resulting cli-path runs --version successfully.
     • The PR states the npm version on the runner and whether its allowScripts handling runs the postinstall, with the log line that shows it.
     • lane.cjs no longer calls latest the default.

   • Sequencing / dependencies: independent of the intake-triage work. Builds on #803's pin.

   • Evidence:

     • HIGH (single source), the manifest: Anthropic's setup page states that each release from 2.1.89 onward publishes a GPG-signed manifest.json with SHA256 checksums for each platform binary, and that the npm package pulls the native binary through a per-platform optional dependency linked into place by a postinstall step. Not tested: whether the manifest checksum matches the binary inside the npm platform package. The first acceptance criterion settles it.
     • MEDIUM, reproduced on npm 11.19.0: with --no-save, npm audit signatures audited only the platform package ("audited 1 package"); a saved install audited both ("audited 2 packages"). --prefix is honoured. Packages from a registry with no keys are skipped and the run still exits 0 (npm/cli#10018). Behaviour sources: verifying registry signatures, npm-audit docs, audit.js, verify-signatures.js.
     • MEDIUM (single publisher, npm/cli source): invalid and missing signatures both exit 1, and the audit does not hash files on disk. That is why the manifest check is the one that covers the binary on disk.
     • MEDIUM: none of the 544 published @anthropic-ai/claude-code versions carries npm provenance attestations (packument), so the npm audit proves only the registry signature.
     • Gap: npm 11.20+ and 12.1+ allowScripts behaviour was not checked (see scope).
3. kyle-sexton

   closed this as completedin #819on Oct 20, 2026
4. kyle-sexton

   added a commit that references this issue on Oct 20, 2026

   fix(run-claude-cli): verify the CLI's npm signatures and signed manif…

   ...

   This issue will close once commit 0af563e is merged into the 'main' branch.

   0af563e