Pin executable build inputs outside the Nix path

[nisavid]

Summary

Pin or verify executable build inputs used by non-Nix build paths.

Source

Migrated from docs/maintainers/security-backlog.md.

Maintained Docs

• Security backlog index and review workflow: docs/maintainers/security-backlog.md
• Threat model: docs/maintainers/threat-model.md
• Package and runtime maintenance: docs/maintainers/package-runtime-maintenance.md
• Build and Run Guide: docs/usage/build-and-run.md

Context

Non-Nix builds fetch npm packages, Electron archives, 7zz archives, and the Rust bootstrap through live endpoints. Some helper fallbacks now carry checked digests, but the broader non-Nix path still relies heavily on TLS, registry behavior, and operator review.

Review Gate

Run the @codex-security workflow before treating implementation as review-ready.

Desired State

• Electron archives and helper downloads have checked integrity metadata.
• npm-based build helpers are pinned through checked-in manifests or an equivalent reproducible tool path.
• Remote shell bootstraps are avoided when a distro package or verified installer is viable.

[coderabbitai]

🔗 Related PRs

#4 - Security hardening and release verification [merged]
#6 - docs(security): persist Apple DMG verification evidence [merged]
#8 - [codex] merge upstream warm-start, zypper, and updater lock updates [merged]
#11 - docs: restore fork docs after PR 10 [merged]
#38 - fix(security): validate generated keybind asset names [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!