{"id":"GHSA-hc4m-q9jh-xw4j","title":"nono-cli'scregistry pack verification can fail open when provenance metadata is absent","summary":"nono-cli'scregistry pack verification can fail open when provenance metadata is absent","severity":"medium","cvss":6.6,"cwe":["CWE-636"],"vendor":"nono-cli","product":"nono-cli","ecosystem":"rust","affected":["nono-cli <= 0.61.2"],"patched":["nono-cli 0.61.3"],"published":"2026-07-28","updated":"2026-07-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-hc4m-q9jh-xw4j","references":[{"url":"https://github.com/always-further/nono/security/advisories/GHSA-hc4m-q9jh-xw4j"},{"url":"https://github.com/nolabs-ai/nono/commit/db07375031642f089d549b4f7b9abece87e39f87"},{"url":"https://github.com/nolabs-ai/nono/releases/tag/v0.62.0"},{"url":"https://github.com/advisories/GHSA-hc4m-q9jh-xw4j"}],"tags":["ghsa","rust"],"ingestedAt":"2026-07-28T16:37:04.545Z","slug":"GHSA-hc4m-q9jh-xw4j","body":"## Overview\n\n## Summary\n\nRegistry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant:\n\n- `~/.config/nono/packages/lockfile.json`\n- `~/.config/nono/packages/<namespace>/<pack>/.nono-trust.bundle`\n\nTesting shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.\n\n## Affected behavior\n\nObserved with `always-further/claude`:\n\n1. Delete `~/.config/nono/packages/lockfile.json`.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n2. Delete `~/.config/nono/packages/always-further/claude/.nono-trust.bundle`.\n\n   Result: the profile loads successfully.\n\n3. Restore `.nono-trust.bundle` while the lockfile is still absent.\n\n   Result:\n\n   ```text\n   nono: Package verification failed for always-further/claude: pack 'always-further/claude' has a trust bundle but no lockfile entry - reinstall with: nono pull always-further/claude --force\n   ```\n\n## Impact\n\nIf both the lockfile entry and trust bundle are absent, nono may accept an installed registry pack without artifact hash verification or provenance verification.\n\nThis is especially important for pack-provided session hooks, because session hooks execute on the host outside the sandbox. A pack that contributes host-executed code should not run unless nono can verify that the code is a locked and trusted pack artifact.\n\n## Root cause\n\n`verify_profile_packs` treats the lockfile entry as optional. Existing code fails when a trust bundle exists without a matching lockfile entry, but when the trust bundle is absent too, there is no equivalent hard failure.\n\nThat creates a fail-open state:\n\n- lockfile entry missing\n- trust bundle missing\n- pack directory still present\n- profile can load\n\n## Recommended fix\n\nFor any registry pack selected for execution, require both:\n\n1. A matching lockfile entry in `~/.config/nono/packages/lockfile.json`.\n2. A present and valid `.nono-trust.bundle` in the installed pack directory.\n\nIf either is missing, fail closed with a reinstall instruction, for example:\n\n```text\nreinstall with: nono pull <namespace>/<pack> --force\n```\n\nThis keeps verification monotonic: removing provenance metadata cannot downgrade a verification failure into a successful launch.\n\n## Affected packages\n\n- `nono-cli <= 0.61.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nono-cli 0.61.3`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}