# What Is the Supply Chain Pin Gate in verify-routing-coherence.ps1?

> Understand the supply chain pin gate in verify-routing-coherence.ps1. Learn how it enforces immutable version locking for auto-install capabilities, securing your CI pipeline.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-13

---

**The supply chain pin gate is a mandatory security validation in `verify-routing-coherence.ps1` that ensures every auto-install capability in the reverse-skill framework is locked to an immutable version, commit, or policy before entering the CI pipeline.**

The `verify-routing-coherence.ps1` script in the `zhaoxuya520/reverse-skill` repository serves as the authoritative validator for routing configuration and operational contracts. Its **supply chain pin gate** specifically targets auto-install capabilities—tools the framework can fetch and install on-the-fly—by enforcing that each dependency references a specific, immutable artifact rather than a mutable source.

## How the Supply Chain Pin Gate Works

The gate operates through a four-stage validation process defined in `skills/scripts/verify-routing-coherence.ps1`. According to the source code, this prevents supply-chain attacks by ensuring reproducibility and auditability across environments.

### Capability Enumeration

The script walks through the manifest files, specifically [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) and platform-specific manifests. It extracts every capability containing an `install` block, identifying tools that might be automatically downloaded during execution.

### Pin Presence Validation

For each auto-install capability, the script evaluates the pinning condition at lines 390-399:

```powershell
$hasPin = ($cap.pinnedVersion -or $cap.pinnedCommit -or $cap.pinPolicy)

```

The three accepted pinning strategies are:

- **pinnedVersion** – A strict semantic version (e.g., `14.10.4`).
- **pinnedCommit** – A specific Git commit SHA.
- **pinPolicy** – A policy resolving to a reproducible artifact (e.g., `winget-latest`).

As implemented in `zhaoxuya520/reverse-skill`, the gate requires at least one of these fields to be present for every auto-install entry.

### Asset Hash Verification

When a capability relies on a downloadable asset, the script mandates an explicit **SHA-256 hash**. This ensures that even if the download URL remains static, the content cannot be silently swapped for malicious code without detection.

### CI Pipeline Enforcement

If any auto-install entry lacks all pinning fields or the required asset hash, the script aborts with a descriptive error. This failure blocks the CI pipeline from succeeding, as documented in the repository's [`CHANGELOG.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CHANGELOG.md) at lines 15-16. This enforcement makes the dependency graph fully auditable and reproducible across environments, as noted in [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) lines 178-180.

## Configuration Examples

### Valid Pinned Capability

The following excerpt from [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) demonstrates a compliant configuration:

```json
{
  "name": "frida-tools",
  "install": {
    "url": "https://github.com/frida/frida/releases/download/{{pinnedVersion}}/frida-tools-{{pinnedVersion}}.zip",
    "pinnedVersion": "14.10.4",
    "sha256": "a1b2c3d4..."
  }
}

```

This entry satisfies the supply chain pin gate by specifying both an immutable version and a cryptographic hash.

### Invalid Configuration

The following configuration triggers a validation failure:

```json
{
  "name": "some-tool",
  "install": {
    "url": "https://example.com/download/some-tool.zip"
  }
}

```

Running `verify-routing-coherence.ps1` against this manifest produces:

```

ERROR: Auto-install capability 'some-tool' lacks a pin (pinnedVersion / pinnedCommit / pinPolicy) or asset hash.

```

## Summary

- The **supply chain pin gate** in `verify-routing-coherence.ps1` validates that every auto-install capability uses immutable references.
- It accepts three pinning strategies: `pinnedVersion`, `pinnedCommit`, or `pinPolicy`.
- The script requires SHA-256 hashes for all downloadable assets to prevent substitution attacks.
- Validation failures abort the CI pipeline, enforcing reproducibility across the `reverse-skill` framework.
- Configuration details are maintained in [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) and validated against platform-specific manifests.

## Frequently Asked Questions

### What happens if a capability lacks a supply chain pin?

The script aborts execution with a descriptive error message and returns a non-zero exit code. This failure prevents the CI pipeline from completing successfully, blocking the unpinned tool from entering the operational environment.

### What are the accepted pinning strategies?

The supply chain pin gate recognizes three valid strategies: `pinnedVersion` for semantic versions like `14.10.4`, `pinnedCommit` for specific Git SHAs, and `pinPolicy` for policies that resolve to reproducible artifacts such as `winget-latest`.

### Why is asset hash verification required alongside pinning?

While pinning ensures you fetch a specific version, hash verification guarantees that the downloaded bytes match exactly what was approved. This prevents attacks where an attacker compromises the distribution server and replaces the pinned version with malicious code bearing the same version number.

### Where is the supply chain pin gate implemented in the codebase?

The validation logic resides in `skills/scripts/verify-routing-coherence.ps1`, specifically between lines 390-399 where the pin presence check occurs. The gate reads configuration from [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) and was introduced according to [`CHANGELOG.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CHANGELOG.md) lines 15-16.