fix(security): add HMAC integrity verification to PickleHandler and module allowlist for agent repository imports - #6871

Open

Varshith-Kali wants to merge 7 commits into

crewAIInc:mainfrom

Varshith-Kali:fix/security-pickle-integrity-and-module-allowlist

Commits on Sep 5, 2026

fix(security): add HMAC integrity verification to PickleHandler and module allowlist for agent repository imports
Varshith-Kali
committed
067c632
fix(security): move HMAC key to home dir, reject unsigned pickles, test loader behavior
Varshith-Kali
committed
1f00eb5
fix(security): harden HMAC key storage validation and test isolation
Varshith-Kali
committed
506b1b2
fix(security): harden key validation, short-write safety, and sig TOCTOU race
Varshith-Kali
committed
7d4744c
fix(security): handle key dir creation race and exercise sig race path
Varshith-Kali
committed
6239952
fix(security): guard POSIX-only key storage checks, reject symlinks via lstat
Varshith-Kali
committed
77ef7f4
Harden repository tool loading with BaseTool subclass check
Varshith-Kali
committed
db4f2cd