{"id":"GHSA-hc4m-q9jh-xw4j","aliases":[],"status":"published","title":"nono-cli'scregistry pack verification can fail open when provenance metadata is absent","description":"## Summary\n\nRegistry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant:\n\n- `~/.config/nono/packages/lockfile.json`\n- `~/.config/nono/packages/\u003cnamespace\u003e/\u003cpack\u003e/.nono-trust.bundle`\n\nTesting shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.\n\n## Affected behavior\n\nObserved with `always-further/claude`:\n\n1. Delete `~/.config/nono/packages/lockfile.json`.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n2. Delete `~/.config/nono/packages/always-further/claude/.nono-trust.bundle`.\n\n   Result: the profile loads successfully.\n\n3. Restore `.nono-trust.bundle` while the lockfile is still absent.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n## Impact\n\nIf both the lockfile entry and trust bundle are absent, nono may accept an installed registry pack without artifact hash verification or provenance verification.\n\nThis is especially important for pack-provided session hooks, because session hooks execute on the host outside the sandbox. A pack that contributes host-executed code should not run unless nono can verify that the code is a locked and trusted pack artifact.\n\n## Root cause\n\n`verify_profile_packs` treats the lockfile entry as optional. Existing code fails when a trust bundle exists without a matching lockfile entry, but when the trust bundle is absent too, there is no equivalent hard failure.\n\nThat creates a fail-open state:\n\n- lockfile entry missing\n- trust bundle missing\n- pack directory still present\n- profile can load\n\n## Recommended fix\n\nFor any registry pack selected for execution, require both:\n\n1. A matching lockfile entry in `~/.config/nono/packages/lockfile.json`.\n2. A present and valid `.nono-trust.bundle` in the installed pack directory.\n\nIf either is missing, fail closed with a reinstall instruction, for example:\n\n```text\nreinstall with: nono pull \u003cnamespace\u003e/\u003cpack\u003e --force\n```\n\nThis keeps verification monotonic: removing provenance metadata cannot downgrade a verification failure into a successful launch.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-636"],"published":"2026-07-28T15:51:30Z","modified":"2026-07-28T16:00:25Z","fixes":[{"ecosystem":"crates.io","package":"nono-cli","fixed_in":["0.61.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"nono-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.61.2"},{"fixed":"0.61.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"nono-cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.61.3"}]}]}],"references":[{"url":"https://github.com/always-further/nono/security/advisories/GHSA-hc4m-q9jh-xw4j","tags":["web"]},{"url":"https://github.com/nolabs-ai/nono/commit/db07375031642f089d549b4f7b9abece87e39f87","tags":["web"]},{"url":"https://github.com/nolabs-ai/nono/releases/tag/v0.62.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hc4m-q9jh-xw4j"},{"url":"https://github.com/always-further/nono","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hc4m-q9jh-xw4j","title":"nono-cli'scregistry pack verification can fail open when provenance metadata is absent","description":"## Summary\n\nRegistry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant:\n\n- `~/.config/nono/packages/lockfile.json`\n- `~/.config/nono/packages/\u003cnamespace\u003e/\u003cpack\u003e/.nono-trust.bundle`\n\nTesting shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.\n\n## Affected behavior\n\nObserved with `always-further/claude`:\n\n1. Delete `~/.config/nono/packages/lockfile.json`.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n2. Delete `~/.config/nono/packages/always-further/claude/.nono-trust.bundle`.\n\n   Result: the profile loads successfully.\n\n3. Restore `.nono-trust.bundle` while the lockfile is still absent.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n## Impact\n\nIf both the lockfile entry and trust bundle are absent, nono may accept an installed registry pack without artifact hash verification or provenance verification.\n\nThis is especially important for pack-provided session hooks, because session hooks execute on the host outside the sandbox. A pack that contributes host-executed code should not run unless nono can verify that the code is a locked and trusted pack artifact.\n\n## Root cause\n\n`verify_profile_packs` treats the lockfile entry as optional. Existing code fails when a trust bundle exists without a matching lockfile entry, but when the trust bundle is absent too, there is no equivalent hard failure.\n\nThat creates a fail-open state:\n\n- lockfile entry missing\n- trust bundle missing\n- pack directory still present\n- profile can load\n\n## Recommended fix\n\nFor any registry pack selected for execution, require both:\n\n1. A matching lockfile entry in `~/.config/nono/packages/lockfile.json`.\n2. A present and valid `.nono-trust.bundle` in the installed pack directory.\n\nIf either is missing, fail closed with a reinstall instruction, for example:\n\n```text\nreinstall with: nono pull \u003cnamespace\u003e/\u003cpack\u003e --force\n```\n\nThis keeps verification monotonic: removing provenance metadata cannot downgrade a verification failure into a successful launch.","status":"published","published":"2026-07-28T15:51:30Z","modified":"2026-07-28T15:51:31Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-636"],"updated_at":"2026-11-02T14:40:53.707378Z"}],"osv":[{"id":"GHSA-hc4m-q9jh-xw4j","title":"nono-cli'scregistry pack verification can fail open when provenance metadata is absent","description":"## Summary\n\nRegistry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant:\n\n- `~/.config/nono/packages/lockfile.json`\n- `~/.config/nono/packages/\u003cnamespace\u003e/\u003cpack\u003e/.nono-trust.bundle`\n\nTesting shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.\n\n## Affected behavior\n\nObserved with `always-further/claude`:\n\n1. Delete `~/.config/nono/packages/lockfile.json`.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n2. Delete `~/.config/nono/packages/always-further/claude/.nono-trust.bundle`.\n\n   Result: the profile loads successfully.\n\n3. Restore `.nono-trust.bundle` while the lockfile is still absent.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n## Impact\n\nIf both the lockfile entry and trust bundle are absent, nono may accept an installed registry pack without artifact hash verification or provenance verification.\n\nThis is especially important for pack-provided session hooks, because session hooks execute on the host outside the sandbox. A pack that contributes host-executed code should not run unless nono can verify that the code is a locked and trusted pack artifact.\n\n## Root cause\n\n`verify_profile_packs` treats the lockfile entry as optional. Existing code fails when a trust bundle exists without a matching lockfile entry, but when the trust bundle is absent too, there is no equivalent hard failure.\n\nThat creates a fail-open state:\n\n- lockfile entry missing\n- trust bundle missing\n- pack directory still present\n- profile can load\n\n## Recommended fix\n\nFor any registry pack selected for execution, require both:\n\n1. A matching lockfile entry in `~/.config/nono/packages/lockfile.json`.\n2. A present and valid `.nono-trust.bundle` in the installed pack directory.\n\nIf either is missing, fail closed with a reinstall instruction, for example:\n\n```text\nreinstall with: nono pull \u003cnamespace\u003e/\u003cpack\u003e --force\n```\n\nThis keeps verification monotonic: removing provenance metadata cannot downgrade a verification failure into a successful launch.","status":"published","published":"2026-07-28T15:51:30Z","modified":"2026-07-28T16:00:25.007445276Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-636"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}