Zoltan Kochan e6cb65ab2f fix: upload the verification log right after the install writes it ...

Saving in the post step left the whole job between the install and the upload.
Anything running in that window — the job's tests, its build, a dependency's
own install scripts — can rewrite the log on disk, and the job's own cache
write would then publish a record claiming some other lockfile passed
verification, for every later job to restore and trust. No cache credentials
needed: the attacker rides the write the job performs anyway.

The log is complete the moment the install finishes, so it is uploaded there.
The post step still covers a job that installs in a step of its own, where
that is the first point the log is known to be final; the save is idempotent
across the two, and the process-local flags exist because main and post do not
share state within a run.

2026-08-13 17:03:37 +02:00

..

index.js

fix: upload the verification log right after the install writes it

2026-08-13 17:03:37 +02:00