release: v0.7.2 — Security Audit Remediation (SA-01 bis SA-07)

- SA-01: Container-DoS / KDF-Amplification Schutz mit Pre-KDF Validierung, max 2 Slots (nur 0 und 1), Slot 0 Pflicht und strikten BLOB-Laengen
- SA-02: Release-Signierung in CI entkoppelt (getrennte build und sign-and-release Jobs, Secret-Isolation)
- SA-03: Pinned Download-Integritaet fuer minisign.exe in CI via SHA-256
- SA-04: Immutable Action-Pinning (@sha) und Toolchain-Pinning (1.85.0) in CI
- SA-05: Session-Token vollstaendig aus URIs verbannt (403 Forbidden bei Vorkommen im Pfad/Query)
- SA-06: Constant-Time Token- und Auth-Vergleiche via subtle::ConstantTimeEq
- SA-07: Dokumentations-Klarstellung bzgl. logischem Shredding vs. physischer SSD/FTL/CoW-Persistenz

.gitea/workflows/release.yaml

@@ -6,16 +6,18 @@ on:
       - 'v*'
 
 jobs:
+  # SA-02 & SA-04: Entkoppelte Build- & Test-Umgebung ohne Zugriff auf Signatur-Secrets
   build:
-    name: Build & Release (Windows x86_64)
+    name: Build & Test (Windows x86_64)
     runs-on: windows-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master commit pinned
         with:
+          toolchain: "1.85.0"
           targets: x86_64-pc-windows-msvc
 
       - name: Run Tests
@@ -47,21 +49,54 @@ jobs:
           
           @("$ZipHash  ${PackageName}.zip", "$ExeHash  sanctum.exe") | Set-Content -Path "${DistDir}/SHA256SUMS.txt" -Encoding utf8
 
-
           echo "ZIP_FILE=$ZipFile" >> $env:GITHUB_OUTPUT
           echo "PACKAGE_NAME=$PackageName" >> $env:GITHUB_OUTPUT
 
-      - name: Sign Checksums with Minisign
+      - name: Upload Build Artifacts
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: dist-artifacts
+          path: dist/
+
+  # SA-02, SA-03 & SA-04: Dedizierter Signatur- & Release-Job mit isolierten Secrets und Prüfsummen-Verifikation
+  sign-and-release:
+    name: Sign & Release
+    needs: [build]
+    runs-on: windows-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - name: Download Build Artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: dist-artifacts
+          path: dist
+
+      - name: Verify and Sign Checksums with Minisign
         shell: pwsh
         env:
           MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
         run: |
+          # SA-02: Secret-Isolation — MINISIGN_SECRET_KEY ist ausschließlich in diesem dedizierten Signier-Job verfügbar
           if (-not $env:MINISIGN_SECRET_KEY) {
             Write-Error "Secret MINISIGN_SECRET_KEY ist nicht gesetzt! Release ohne Signatur verboten."
             exit 1
           }
+
+          # SA-03: Pinned Download-Integrität für minisign.exe mit zwingender SHA-256 Validierung
+          $MinisignUrl = "https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-win64.zip"
+          $ExpectedMinisignHash = "b9c31c2c3034f81f0e5f5d92cbcc20e67a9671b6e5455661588638848dc58031"
+
           if (-not (Get-Command minisign -ErrorAction SilentlyContinue)) {
-            Invoke-WebRequest -Uri "https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-win64.zip" -OutFile "minisign.zip"
+            Write-Host "Lade gepinnten Minisign-Release herunter: $MinisignUrl"
+            Invoke-WebRequest -Uri $MinisignUrl -OutFile "minisign.zip"
+
+            $ActualHash = (Get-FileHash -Path "minisign.zip" -Algorithm SHA256).Hash.ToLower()
+            if ($ActualHash -ne $ExpectedMinisignHash) {
+              Write-Error "KRITISCHER SICHERHEITSFEHLER: Minisign SHA-256 Prüfsumme ungültig!`nErwartet: $ExpectedMinisignHash`nErhalten: $ActualHash`nAbbruch."
+              exit 1
+            }
+            Write-Host "Minisign SHA-256 Integrität erfolgreich verifiziert ($ActualHash)."
+
             Expand-Archive -Path "minisign.zip" -DestinationPath "minisign-bin"
             $MinisignExe = "minisign-bin/minisign-win64/minisign.exe"
           } else {
@@ -81,14 +116,12 @@ jobs:
           }
 
       - name: Create Gitea Release
-        uses: softprops/action-gh-release@v2
-        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
         with:
           files: |
             dist/*.zip
             dist/SHA256SUMS.txt
             dist/SHA256SUMS.txt.minisig
-            target/release/sanctum.exe
           body_path: CHANGELOG.md
           draft: false
           prerelease: false