## Problem/Motivation Found in the sixth release audit of 1.x at `f35b8a9`. This audit wrote each attack against the module's trust decisions as a kernel test, ran every flag that alerts over several cron ticks, and mutated each integrity guard to see whether a test fails. ### Security 1. **An acknowledgment can excuse its own record.** The verifier honors an acknowledgment when its index row matches the chain event recording it and its anchors hold. Nothing requires the range to end before that event. An attacker with database write access and no secret widens a real acknowledgment, in the index and in the event's stored context, until it reaches the head of the chain, then tampers with any row in that range. The edited event fails its signature, but it lies inside the range it now excuses, so the walk skips it. A Strict full verification then reports `Chain "webdav" verified: 5 entries intact.` 2. **A forged checkpoint is never logged, and its trace clears itself.** A checkpoint whose signature does not verify leaves `ok` alone when the surviving rows verify, so the "no longer verifies" log line is never written. The next checkpoint the incremental walk writes replaces it as the latest, and the stored verdict and the status report stop naming it. Unless its secret is gone or its version unreadable, such a checkpoint was changed without the signing secret, and after a few cron ticks nothing says it happened. (Deleting the checkpoint instead leaves no trace at all, which the threat model already lists as out of reach.) 3. **An imported archive's footer range is not checked.** With *Allow import without secret* (form) or `--allow-missing-secret` (Drush), the footer is taken as found, and its `from_id`/`to_id` go into the segment table unchecked. Segments covering rows `[9, 3]` and `[0, 0]` were recorded. Every other range the module accepts goes through `ChainRange::assertValid()`. Only an administrator can import. ### False text 4. The status report gives two reasons a checkpoint fails to validate. The verifier gives three; the report leaves out a checkpoint recording a version this release cannot read. ### Untested guards 5. Five of the checks that keep a gap in the chain from being explained away fail no test when removed: the acknowledgment bridge's comparison with the chain's record and its check of the row before the gap, the segment bridge's identity and content signatures, and its requirement that the segment itself was purged. A test docblock says the last of those "is caught elsewhere"; no test class catches it. ## Proposed resolution 1. An acknowledgment event whose range reaches its own row is ignored. Recording and updating an acknowledgment both check the range against the head under the chain's write lock before appending the event, so every event this module writes passes. 2. A forged checkpoint is logged as `critical` on the cron run that first sees it, and by whichever walk replaces it with a new checkpoint: cron, the chain pages and Drush all run the incremental walk, and each of them mints. 3. An import whose footer range is not a range of rows is refused before anything is written. 4. The status report names all three reasons. 5. Each guard gets a test that performs the attack it stops. Tests: - A widened acknowledgment, record included, does not hide tampered rows. - A forged checkpoint writes one critical line when cron finds it and one when a walk replaces it, both still there after the verdict stops naming it; replaced by a verify run by hand before cron looks, it is still logged. - Importing footers naming rows `[9, 3]`, `[0, 0]` and `[-4, 2]` is refused, and no segment is recorded. - A segment with any one forged signature does not bridge; an unpurged archive beside a purged one does not bridge; an acknowledgment widened in the index only, or starting after the gap does, does not bridge. ## Remaining tasks None. ## User interface changes - The site log gets a critical line when a checkpoint stops verifying, and one when a walk replaces such a checkpoint. - The status report names the third reason a checkpoint fails to validate. ## API changes None. AI-Generated: Yes (Claude Code was used to help draft this issue summary. I reviewed it.)