[j0ntz]

Technical Design Document

pirate-sdk-provenance-gate.md

Description

Asana task

Adds a CI gate for the react-native-pirate-wallet* packages, which ship prebuilt native code (JNI libraries and xcframeworks) that loads in-process next to wallet keys. The lockfile only proves the bytes did not change since the last npm install. This gate also checks where they came from. It answers the unresolved Cursor Security Agent thread on EdgeApp/edge-react-gui#6021.

• scripts/pirateSdkPins.json records the reviewed version and integrity hash of every Pirate package, plus the upstream repository, workflow, tag and commit (PirateNetwork/Stashi-Wallet v1.2.6). Any lockfile drift fails until the pins change in the same PR.
• scripts/verifyPirateSdk.ts checks each pin. Six packages have npm SLSA provenance, and the gate requires it to bind the lockfile hash to the pinned repository, workflow, tag and commit.
• react-native-pirate-wallet-android-external (the package the Android build links) has no provenance. Its tarball sha256 is pinned instead, taken from the copy inside the upstream release bundle, whose zip is listed in the release's PGP-signed sha256sum file.
• The script also runs npm audit signatures and fails on any invalid or missing Pirate package.
• npm run verify:pirate-sdk runs in .travis.yml after npm test.

Verification of the pin source: the PGP signature on the release's sha256sum-v1.2.6.txt verifies (RSA, SHA-512) against the key with fingerprint E4FB2399AECCF9B9447DED472CE65343401553A6, which the upstream repository publishes in release-signing/README. That check was a one-time manual step and is not part of the script. The Sigstore chain is verified by npm audit signatures, not by the script. The npm audit signatures invalid-signature branch was not exercised.

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

[claude]

Claude Code Review

Claude Code Review is paused for this repository because its GitHub organization is not linked to your Claude organization.

To turn it back on, one person needs both roles: owner of the GitHub organization (or the account owner, for a personal repository) and admin or owner of your Claude organization. If that is not you, pass this on to someone who is.

Open Organization settings, Git providers and click Link next to the GitHub organization's name. If it is not listed, click Enable GitHub integration or Connect your GitHub first, whichever the page shows.

New pull requests are then reviewed as before. To get a review on one that is already open, someone with write access can comment @claude review.

_{Tip: disable this comment in your organization's Code Review settings.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-24T22:33:51.855679Z We couldn’t complete this review. Comment @codex review to try again.	02ff674	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.