AIIR verification and policy gates could report 'verified' success without enforcing the check
Undisclosed·AIIR (aiir Python package) verification/policy gates, including require_signing, release-verification, and CI verification checksFixed
AIIR's require_signing policy gate could be satisfied by a forgeable/empty field so an unsigned or forged-bundle receipt passed a 'signing required' check without a valid signature; a CI verification path could report success regardless of the underlying verification result; a release-verification gate could advertise policy limits it did not actually enforce; and a signature-verification path could be silently skipped for certain input categories while still exiting success.
- Blast radius
- No third-party exploitation or named victim was disclosed; the flaw meant any consumer relying on the require_signing, release/policy, or CI verification gates in aiir versions before 1.7.0 could have received a false 'verified'/'pass' result for unsigned, forged, or non-conforming receipts. It did not forge valid signatures or compromise content-addressing/correctly-signed receipts.
- Root cause
- Multiple verification/policy code paths defaulted to returning a success result when the underlying check was incomplete, given malformed/empty input, or skipped for certain input categories, rather than failing closed (CWE-636/CWE-347).
- How it was caught
- Found internally during an adversarial hardening review of AIIR by its own maintainers, not by a third-party audit or an incident in production.
- What changed
- All affected paths were fixed in aiir 1.7.0, each now fails closed with an added regression test; users are advised to upgrade to >=1.7.0 and can additionally enable full cryptographic Sigstore verification (--verify-signature with --signer-identity/--signer-issuer) as defense in depth.
Take-awayA verification or policy gate that can silently return 'success' on error, empty input, or an unhandled code path is more dangerous than no gate at all — every such check must fail closed by default and be covered by a negative-path regression test.