[Crash0v3rrid3]

Why

The Security retest of DEVA11Y-473 at 806f98cb found two gaps:

1. The CLI checksum check let the binary run unverified whenever the .sha256 file was missing, unreachable or malformed.
2. followRedirects() / download() accepted any redirect target, so an http:// or off-domain hop would be followed. URLSession.shared also auto-follows redirects.

The CDN (sdk-assets.browserstack.com) does not and will not publish checksums, so a checksum could never be verified. Security agreed to verify the binary's own code signature instead, and accepted the Linux residual risk with conditions (comment 2471198).

What

f882c50 – redirect allowlist

• Downloads go through a session whose delegate only follows redirects to https on browserstack.com / *.browserstack.com.
• The vetoed Location and the final response.url are re-checked as a backstop.
• The initial URL is still governed by parseOverride() (HTTPS only).

b8046c3 – signature verification, failing closed (replaces the checksum approach in 2e23e29)

• macOS: /usr/bin/codesign --verify --strict with a Developer ID requirement pinned to Team YQ5FZQ855D.
• Windows: Get-AuthenticodeSignature must be Valid, with an O=BrowserStack, Inc. signer.
• Linux: the build is unsigned. The plugin logs the accepted risk and proceeds; follow-up is SDK-6482.
• Where it runs:
  • on the staged binary, before it is made executable or published;
  • on cache hits: a cached binary that fails is discarded and downloaded again, which also covers caches filled by older, unverified plugin versions;
  • on the final published binary, because publish can keep a copy a concurrent build published.
• verifyArchiveChecksum, sha256Hex and the sidecar fetch are removed entirely. README updated.

Testing

Requirement check, run against the real 1.62.1 macOS binary:

Binary	Result
Genuine	✅ passes
Flipped byte	❌ rejected
Ad-hoc signed	❌ rejected
Signature stripped	❌ rejected
Genuine, requirement pinned to a different team	❌ rejected

End-to-end via swift package … scan (macOS arm64, real network):

Scenario	Result
Default path, forced fresh download	✅ verifies and runs the CLI
Cached binary replaced with an ad-hoc-signed copy	✅ rejected, downloaded again, genuine binary (Team YQ5FZQ855D) restored, run succeeds
Override to the unsigned Linux build on macOS	✅ code object is not signed at all, rejected before chmod/publish; good cache untouched, no staging leftovers
Override redirecting off-domain (GitHub → codeload.github.com)	✅ rejected
Override redirecting https → http://sdk-assets.browserstack.com/…	✅ rejected

CI: all checks green, including a11y-scan end-to-end (SwiftPM).

Not tested: the Windows Authenticode path. I had no Windows host and CI has no Windows job. The signer (BrowserStack, Inc., Sectigo Public Code Signing CA R36) was confirmed from the real binary-win-x64.exe certificate table.

Out of scope

• Launcher scripts (scripts/*/cli.sh): they don't yet verify the binary's signature. Tracked in DEVA11Y-474, per Security's condition 3.
• Linux verification: blocked until the Linux build is signed or the API serves a digest (SDK-6482 Approach A).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: b03ed64d-4ff9-4959-9b02-b6a1dc19d4f9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[Crash0v3rrid3]

@rahul-bs @gobind-singh Ready for Security review. This is the rework you asked for on DEVA11Y-473 (comment 2471198):

• Redirects are only followed to https on browserstack.com.
• macOS: codesign --verify --strict, pinned to Team YQ5FZQ855D.
• Windows: Authenticode, pinned to O=BrowserStack, Inc.
• Both checks fail closed, and the fail-open checksum path has been removed entirely.
• Linux follows the accepted risk, with SDK-6482 as the follow-up.

The launcher scripts are handled separately under DEVA11Y-474. The Windows path is not exercised in CI (there is no Windows runner); details are in the description.