10/14

SECURITY_DESIGN.txt

@@ -27,6 +27,9 @@ it. This phase is INTEGRITY ONLY. Authenticity (signing, a trusted
 keyring) is a deliberate future phase, tied to remote-repo support —
 not being designed in detail now, but a few choices below are made to
 stay cheap to extend into later.
+[2026-10-06: that phase is REPO_DESIGN.txt. Its first part is in: a
+base package installed with syspkg -l needs a signed sidecar
+(REPO_DESIGN section 7).]
 
 Everest is a security-focused distro (this is also *why* per-user
 package isolation exists in the first place). Two sides of the CIA
@@ -209,6 +212,17 @@ refusing otherwise. The actual privilege boundary is enforced by doas
 — a hardened, audited, purpose-built tool for exactly this — not
 reimplemented inside syspkg itself.
 
+LATER AMENDMENT (loading, as built): syspkg and gstore run under
+`luajit -E`, and pin package.path and every ffi.load to their own
+realpath's lib/. Before loading anything as root, each file they load
+(every .lua, every .so, including those pulled in through $ORIGIN) and
+lib/ itself must be root-owned and not group/world-writable, and so
+must every ancestor of the script's realpath AND of each loaded file's
+realpath. The second set matters once installed: lib/glacier is a
+symlink to /usr/lib/glacier, whose entries link into libglacier-ng's
+store directory, a tree the script's own ancestors never reach
+(2026-10-06, CLAUDE.md bug 29).
+
 
 +--------------------------------------------+
 | 7. Shared code: gpkg_common.lua            |