# How test-bootstrap-supply-chain.ps1 Ensures Tool Verification and Security in Reverse-Skill

> Learn how test-bootstrap-supply-chain.ps1 ensures tool verification and security in reverse-skill. Discover its validation methods for robust platform integrity.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-18

---

**`test-bootstrap-supply-chain.ps1` validates tool integrity through existence checks, version verification, cryptographic hashing, and signature validation before any external binary is executed in the reverse-skill platform.**

The `zhaoxuya520/reverse-skill` repository implements a defense-in-depth supply chain security model for reverse engineering workflows. At its core sits `test-bootstrap-supply-chain.ps1`, a PowerShell test driver that prevents malicious or compromised tools from entering the execution pipeline by enforcing four sequential verification gates.

## Supply Chain Verification Architecture

The script operates as an orchestrator, delegating security-critical operations to specialized helper functions while maintaining a strict fail-fast policy. Any verification failure immediately halts execution with a non-zero exit code.

### Loading the Verification Engine

The script initializes by sourcing the core verification library:

```powershell
. (Join-Path $PSScriptRoot 'lib/BootstrapSupplyChain.ps1')

```

This loads functions from `skills/scripts/lib/BootstrapSupplyChain.ps1` that handle hash computation, signature validation, and version parsing against the repository's trust manifest.

### Tool Discovery and Manifest Enforcement

Rather than trusting arbitrary binaries on `$PATH`, the script first identifies explicitly permitted tools through `Get-DeclaredTools` in `skills/scripts/lib/ToolDiscovery.ps1`. This function parses the repository's tool manifest and returns a curated list of expected binaries—typically including `radare2`, `ida`, and `apktool` for reverse engineering operations.

## Four-Layer Security Validation

Each discovered tool passes through sequential verification stages defined in `BootstrapSupplyChain.ps1`. The implementation references specific line ranges where these checks reside.

### 1. Existence and Version Verification (`Assert-ToolPresent`)

Lines 45-68 of `BootstrapSupplyChain.ps1` implement the first gate:

- Locates the executable via `$PATH` or manifest-defined absolute path
- Extracts version strings through tool-specific parsing logic
- Compares against `$AllowedVersions`, a whitelist maintained in the verification library

Tools with versions outside the permitted range are rejected immediately, blocking known-vulnerable releases from execution.

### 2. Cryptographic Hash Validation (`Assert-HashMatches`)

Lines 71-84 enforce binary integrity through SHA-256 verification:

- Reads the complete file content
- Computes hash via `Get-FileHash -Algorithm SHA256`
- Matches against known-good hashes embedded in the verification state

This detects file corruption, partial downloads, or binary replacement attacks.

### 3. Digital Signature Verification (`Assert-SignatureValid`)

Lines 86-101 implement signature validation for tools providing cryptographic attestation:

- Detects companion `.sig` files or PGP-signed checksums
- Validates against public keys stored in `keys/trusted-keys.gpg`
- Rejects binaries with missing, invalid, or untrusted signatures

This blocks rebuilds from compromised build environments or unauthorized modifications to released artifacts.

### 4. Aggregated Reporting and Exit Code Propagation

The test driver collects individual verification results and emits structured output:

```

[+] radare2     → 5.8.0  (hash OK, signature verified)
[+] ida        → 7.5  (hash OK, signature verified)
[+] apktool    → 2.9.0 (hash OK, signature verified)

```

Failure modes produce explicit diagnostics:

```

[!] radare2 not found or version mismatch.
Error: Tool verification failed – aborting.

```

## Practical Execution Patterns

### Manual Verification

Run the complete supply chain check from repository root:

```powershell
powershell -NoProfile -File skills/scripts/test-bootstrap-supply-chain.ps1

```

### CI/CD Integration

Embed as a mandatory gate in GitHub Actions:

```yaml

# .github/workflows/ci.yml

- name: Verify tool supply-chain
  run: powershell -NoProfile -File skills/scripts/test-bootstrap-supply-chain.ps1

```

The non-zero exit code on failure prevents subsequent workflow steps from executing with untrusted tools.

## Critical Implementation Files

| File Path | Security Function |
|-----------|-------------------|
| `skills/scripts/test-bootstrap-supply-chain.ps1` | Orchestration driver and result aggregation |
| `skills/scripts/lib/BootstrapSupplyChain.ps1` | Core verification: `Assert-ToolPresent`, `Assert-HashMatches`, `Assert-SignatureValid` |
| `skills/scripts/lib/ToolDiscovery.ps1` | Manifest parsing via `Get-DeclaredTools` |
| [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) | JSON trust store: allowed versions and reference hashes |
| `keys/trusted-keys.gpg` | GPG public keyring for signature validation |

## Summary

- **`test-bootstrap-supply-chain.ps1`** enforces mandatory tool verification before execution in the reverse-skill platform
- **Four verification layers**: existence, version whitelist, SHA-256 hash, and cryptographic signature
- **Fail-fast design**: Any check failure aborts with non-zero exit code, protecting downstream operations
- **Manifest-driven trust**: Only explicitly listed tools from `ToolDiscovery.ps1` are considered valid
- **Reproducible security**: Identical verification logic runs locally and in CI/CD pipelines

## Frequently Asked Questions

### What happens if a tool version is newer than the allowed list?

The script rejects it. `Assert-ToolPresent` compares extracted versions against `$AllowedVersions` in `BootstrapSupplyChain.ps1` (lines 45-68). Only explicitly whitelisted versions pass; newer releases require manifest updates and hash/signature verification before approval.

### How does the script handle tools without digital signatures?

Hash validation remains mandatory. Tools lacking `.sig` or PGP signatures skip `Assert-SignatureValid` (lines 86-101) but must still pass `Assert-HashMatches` (lines 71-84). The repository recommends prioritizing signed releases where available.

### Can verification be bypassed for development purposes?

No supported bypass mechanism exists in the source. The script's design intentionally prevents override flags. To use alternate tool versions, modify [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) with new hashes and signatures, then commit the updated trust state.

### Where are the trusted cryptographic keys stored?

Public keys for signature verification reside in `keys/trusted-keys.gpg` relative to repository root. `Assert-SignatureValid` references this keyring when validating tool signatures against known-good signers.