WASM-PROVENANCE.md

1.4 KB · raw

rendered · source

WASM Blob Provenance

Target location: repository root (WASM-PROVENANCE.md). Added by audit fix LV-9.

The following packages ship prebuilt .wasm blobs that have not been byte-verified against a reproducible build:

@bokuweb/[email protected] — zstd compression (Codex / PeachScript payloads)
@subspace/[email protected] — Codex erasure coding
[email protected] — Argon2id KDF (crypto-critical)
vendored public/ggwave/ggwave.js + ggwave.wasm — ultrasonic pairing (carries local patch PEACH-PATCH LV-7; see src/drafts/AUDIT-FIXES/patches/LV-7-ggwave-newfunction-proto.md)

These are pinned to exact versions in package.json (audit fix LV-9). Any version bump requires, before merge:

Manual review of the upstream diff/release notes.
SHA-256 of the shipped .wasm blob recorded below, verified against the upstream release artifact (or a local reproducible build where upstream provides one).
Re-application of any local patches (currently: ggwave LV-7).

Recorded digests

Populate at integration time (shasum -a 256 <blob>), one line per blob:

<sha256>  node_modules/hash-wasm/dist/... (argon2id wasm)
<sha256>  node_modules/@bokuweb/zstd-wasm/dist/... (zstd wasm)
<sha256>  node_modules/@subspace/reed-solomon-erasure.wasm/... (rs wasm)
<sha256>  public/ggwave/ggwave.wasm

Audit reference: peach-browser-security-audit.md, Open Question 3.