Summary
bol/injector.exe is a prebuilt Wine x86_64 PE binary (built from src/injector.c) committed to the repo as a binary blob. Unlike the managed engine and the OpenSSL-XCurl set, it is not reproducibly built in CI, SHA-pinned in config.py, or attested. A reviewer cannot verify that the committed .exe corresponds to the reviewed src/injector.c without a matching mingw toolchain.
This is the one committed native binary that falls outside the fork's "build from source, reproducibly, attested" posture. It is covered transitively (the .deb/AppImage/.pyz app artifacts are attested and bundle it), but the src/injector.c -> injector.exe link itself is not independently verifiable.
Proposed work
Give the injector the same treatment as the OpenSSL-XCurl set:
- A CI job compiles
src/injector.c with a pinned x86_64-w64-mingw32-gcc toolchain.
- Zero PE timestamps / fix the image base for byte-reproducibility (reuse
scripts/pe-zero-timestamps.py).
- Assert the built SHA-256 matches a new
INJECTOR_SHA256 pin in bol/config.py, and attest the artifact.
- CI verifies the committed
injector.exe reproduces from source (fail closed on drift).
Priority
Defense-in-depth, not a security regression. The injected code is reviewed source and the app artifact is attested; this upgrades it to independently verifiable. Tracked separately from the 2.1.x sync so it can be scoped and toolchain-pinned on its own.
Summary
bol/injector.exeis a prebuilt Wine x86_64 PE binary (built fromsrc/injector.c) committed to the repo as a binary blob. Unlike the managed engine and the OpenSSL-XCurl set, it is not reproducibly built in CI, SHA-pinned inconfig.py, or attested. A reviewer cannot verify that the committed.execorresponds to the reviewedsrc/injector.cwithout a matching mingw toolchain.This is the one committed native binary that falls outside the fork's "build from source, reproducibly, attested" posture. It is covered transitively (the
.deb/AppImage/.pyzapp artifacts are attested and bundle it), but thesrc/injector.c->injector.exelink itself is not independently verifiable.Proposed work
Give the injector the same treatment as the OpenSSL-XCurl set:
src/injector.cwith a pinnedx86_64-w64-mingw32-gcctoolchain.scripts/pe-zero-timestamps.py).INJECTOR_SHA256pin inbol/config.py, and attest the artifact.injector.exereproduces from source (fail closed on drift).Priority
Defense-in-depth, not a security regression. The injected code is reviewed source and the app artifact is attested; this upgrades it to independently verifiable. Tracked separately from the 2.1.x sync so it can be scoped and toolchain-pinned on its own.