From 4836b9a1460f6b97fc21a1774a254066e53030f9 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Thu, 30 Jul 2026 00:59:40 +0200 Subject: [PATCH] security: record the mimalloc local patch in the vendored manifest The release build blocked at Layer 8 (vendored dependency integrity): MISMATCH: vendored/mimalloc/src/options.c expected: 96ef01e4... actual: 192ce06a... That is the integrity check working exactly as designed. The hardening pass patched mimalloc's version banner to stop baking __DATE__/__TIME__ into every binary, which is an intentional and reviewed change to vendored code -- but an intentional change is indistinguishable from a supply-chain edit until someone records it, which is the entire point of the manifest. Updating the recorded checksum is the review being written down. Scope verified before committing: the manifest diff is exactly ONE line, the options.c hash, and it matches the hash CI computed. No other vendored file moved. scripts/security-vendored.sh's other layers still pass on the updated tree -- no subprocess, network or dangerous calls in vendored code, dlopen confined to sqlite3. Signed-off-by: Martin Vogel --- scripts/vendored-checksums.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/vendored-checksums.txt b/scripts/vendored-checksums.txt index c72c13f75..1c9e71d85 100644 --- a/scripts/vendored-checksums.txt +++ b/scripts/vendored-checksums.txt @@ -20,7 +20,7 @@ c9a845dd7b9020f26d73761d235fb75e7bc4a3682576de750050ac4098211b43 vendored/mimal ae8e88737c9861e8e071fe5f1e7acc52093bcffd136a359a6b473101e968c14f vendored/mimalloc/src/heap.c eca1fe77d72ab2aaccc447c8119056e9c4e8851bda9a95472b573539f76107ad vendored/mimalloc/src/init.c ebd95b475f15d5387e6ef3c88a9cb47b88e64d7e55998ae1dc656614676a443b vendored/mimalloc/src/libc.c -96ef01e41f4b3043118e8c801e660b1d3f185d6fb824e5298a038aee89b6a392 vendored/mimalloc/src/options.c +192ce06ac9076445d223205fb340d8a1fc818dbf2b4c4a801dfd2c10bc6c1162 vendored/mimalloc/src/options.c 011e965f28c0e2c885a6834d51bd756a458dd37ebfed6fd4d9ad6607ce0390ed vendored/mimalloc/src/os.c 1be3a208c678fc34187c2a8ffb75f3fe1eecc674bbf8b2af4d1f329506b1fad5 vendored/mimalloc/src/page-map.c 7ec275805c9f00eb66710ffa99817b3ed1dba9826435d08f4866f7935152f6ae vendored/mimalloc/src/page-queue.c