{"id":"GHSA-hc4m-q9jh-xw4j","aliases":[],"url":"https://o3.security/vulnerability/GHSA-hc4m-q9jh-xw4j","summary":"nono-cli'scregistry pack verification can fail open when provenance metadata is absent","details":"## Summary\n\nRegistry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant:\n\n- `~/.config/nono/packages/lockfile.json`\n- `~/.config/nono/packages/<namespace>/<pack>/.nono-trust.bundle`\n\nTesting shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.\n\n## Affected behavior\n\nObserved with `always-further/claude`:\n\n1. Delete `~/.config/nono/packages/lockfile.json`.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n2. Delete `~/.config/nono/packages/always-further/claude/.nono-trust.bundle`.\n\n   Result: the profile loads successfully.\n\n3. Restore `.nono-trust.bundle` while the lockfile is still absent.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n## Impact\n\nIf both the lockfile entry and trust bundle are absent, nono may accept an installed registry pack without artifact hash verification or provenance verification.\n\nThis is especially important for pack-provided session hooks, because session hooks execute on the host outside the sandbox. A pack that contributes host-executed code should not run unless nono can verify that the code is a locked and trusted pack artifact.\n\n## Root cause\n\n`verify_profile_packs` treats the lockfile entry as optional. Existing code fails when a trust bundle exists without a matching lockfile entry, but when the trust bundle is absent too, there is no equivalent hard failure.\n\nThat creates a fail-open state:\n\n- lockfile entry missing\n- trust bundle missing\n- pack directory still present\n- profile can load\n\n## Recommended fix\n\nFor any registry pack selected for execution, require both:\n\n1. A matching lockfile entry in `~/.config/nono/packages/lockfile.json`.\n2. A present and valid `.nono-trust.bundle` in the installed pack directory.\n\nIf either is missing, fail closed with a reinstall instruction, for example:\n\n```text\nreinstall with: nono pull <namespace>/<pack> --force\n```\n\nThis keeps verification monotonic: removing provenance metadata cannot downgrade a verification failure into a successful launch.","published":"2026-07-28T15:51:30Z","modified":"2026-07-28T16:00:25.007445276Z","cvss":{"score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"nono-cli","fixedVersion":"0.61.3"}],"fix":{"url":"https://github.com/nolabs-ai/nono/commit/db07375031642f089d549b4f7b9abece87e39f87","label":"nolabs-ai/nono@db07375"},"references":[{"type":"WEB","url":"https://github.com/always-further/nono/security/advisories/GHSA-hc4m-q9jh-xw4j"},{"type":"WEB","url":"https://github.com/nolabs-ai/nono/commit/db07375031642f089d549b4f7b9abece87e39f87"},{"type":"PACKAGE","url":"https://github.com/always-further/nono"},{"type":"WEB","url":"https://github.com/nolabs-ai/nono/releases/tag/v0.62.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-28T16:00:25.007445276Z"}}