security(release/P0): anchor Tauri tag verification to trusted code and exact event SHA before v1.29.3 #1206

Release-blocking finding (P0)

The current .github/workflows/tauri-build.yml verify-release-tag job checks out the tagged source and runs node scripts/signing/verify-github-signatures.mjs from that same checkout, before authorizing the signed desktop release. This means the revision under verification supplies its own verifier. The shared verifier also resolves a mutable tag name through GitHub's API without an independent required equality check against the original push-event github.sha. These are trust-boundary/provenance gaps, not proof that a malicious release occurred.

Release decision: BLOCKS v1.29.3 tag creation and desktop publication until the controls and required exact-ref evidence below are proved. Do not merge a GHCR-only correction and mistake it for Tauri release authorization.

Proven scope and ownership

• Current main Tauri workflow: .github/workflows/tauri-build.yml, verify-release-tag (lines 20–41 at d9c02fc9426fb4da42fae63fbcc5d9139a20bb07).
• Signature implementation: scripts/signing/verify-github-signatures.mjs and scripts/signing/verify-remote.mjs.
• Coordinated GHCR predecessor: PR fix(release): require verified version-tag pushes for GHCR #1205, particularly CodeAnt's three critical threads on tag retargeting, tag-controlled verifier and inherited verifier environment.
• Release owner: release(v1.29.3): publish signed interim maintenance release with refreshed desktop assets, updater and credential preflight #1201; exact-SHA audit owner: release: make tag-time publishing depend on the security audit (Tauri release + GHCR) #911.
• Maintainer reports newly created v* creation and immutable-tag GitHub rulesets. These are reported, not independently verified; authenticated effective-ruleset inspection is required.

Required remediation

1. Trusted verifier origin: load/run verifier code from a separately trusted, reviewed immutable pin, not from the untrusted target tag. Preserve read-only, exact-source, pinned third-party actions, least-privilege permissions, and avoid arbitrary untrusted execution before verification. Assess whether pin rotation is secure and reproducible after merges.
2. Exact event-to-artifact binding: verify actual push-event type, refs/tags/v* ref, annotated tag signature and target commit signature; require verified target commit SHA to equal github.sha from the immutable event context. Reject missing/deleted/retargeted tag, mismatched ref, lightweight/unsigned/unverified tag, wrong-commit signature and API failures. Preserve exact-SHA OSV audit of all three lockfiles and strict gated release job needs.
3. Ref protection evidence: in authenticated read-only inspection enumerate active repository/parent tag rulesets and evaluate how they match refs/tags/v1.29.3; capture enforcement, rules (creation, updates, deletions), bypass actors/modes and the authenticated tag-push actor. Confirm GH Actions github.ref_protected semantics with this protection configuration. Do not create a v* test tag to probe behavior.
4. Policy & execution integrity: reject if, continue-on-error, unsafe environment shadowing such as NODE_OPTIONS, writable/verifier-controlled execution roots, extra publish branches and unchecked writer jobs. Negative tests must demonstrate failed gates for each relevant mutation.
5. Tauri publishing parity: desktop release must depend on trusted signature proof, exact tag/ref, audited event SHA and complete all-platform signed updater payload. Preserve the all-or-nothing staging/verification path from merged PR ci(release): require complete, verified desktop assets before publishing #1202; do not weaken it or change secrets/keys without authorization.
6. No-release regression evidence: run targeted tests, signature proof negatives, full workflow/security-policy checks, CodeAnt, CodeScene, CodeQL, normal protected PR CI. Before the real versioned tag, capture a safe nonpublishing proof with no registry/release writes. All commits signed and review threads resolved with evidence.

Acceptance criteria

• Trust-root diagram and concrete immutable verifier pin documented and enforced.
• Tag signature + exact github.sha equivalence, fail-closed behavior, real v* tag-protection evidence demonstrated.
• Negative tests: tag retarget/delete/lightweight/unsigned/mismatch; verifier substitution; step skip/failure continuation; environment injection; untrusted checkout.
• Tauri publish job cannot run unless all trusted prerequisites succeeded; zero weaker alternative paths.
• PR within repo governance and commit budget, no PII in authored content, all required hosted checks terminal green.
• release(v1.29.3): publish signed interim maintenance release with refreshed desktop assets, updater and credential preflight #1201 explicitly references this blocker and its satisfying merge SHA; release remains HOLD until signed final exact-main, native upgrade/data-preservation and all 3-OS updater/signature/asset checks complete.

Execution constraints

One local Codex CLI writer in Ubuntu/VS Code; protected main, no direct push, normally signed commits, reviewable PR, batch pushes, no security suppression/waiver. Create a small successor PR after GHCR PR #1205, keeping the two pipelines' acceptance criteria distinct. No tag, GitHub Release, GHCR package push or Vercel destructive mutation is authorized by this issue.