Security & Trust

Cloning a repository never runs its config, and every binary avm downloads is verified before it's unpacked.

Trusting a project

A project's .avm.json aliases and env, and its .env files, run with your privileges and reach every shimmed node/java. So avm ignores them until you trust that exact file content. Tool pins only pick a version and always apply.

$ cd cloned-repo
$ avm trust            # shows the aliases/env it enables, then trusts them
$ avm trust --list     # everything you've trusted
$ avm trust --revoke   # stop trusting this directory

Trust is stored as path → sha256 in ~/.avm/trusted.json. Any edit made outside avm blocks the file again; avm init, avm add and avm env add keep a trusted file trusted.
Your global ~/.avm.json is always trusted and can list "trusted_paths": ["~/work/**"].
AVM_TRUST_ALL=1 trusts everything, for CI. It's never implied by CI=true.

Verified downloads

Plugins: avm plugin add checks the archive against the release's checksums.txt before extracting. A mismatch aborts with nothing installed.
Runtimes: Node.js is checked against SHASUMS256.txt, Temurin JDKs against foojay's sha256, and the Android cmdline-tools zip against a pinned sha256 (sdkmanager verifies the rest).
avm itself: install.sh, install.ps1 and the npm installer verify avm-bin the same way.
Provenance: every release carries a GitHub build attestation. Check it with gh attestation verify <archive> --owner PrajaNova.
AVM_ALLOW_UNVERIFIED=1 is the only way to skip verification.