OFAC list ingestion resiliency: signed source verification and reproducible parse

[thlpkee20-wq]

Description

The OFAC list is downloaded from a public URL; today we do not verify signatures nor lock the parse to reproducible bytes. Fetch with signature verification and pin the parser output hash so drift is detected immediately.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: sanctions loader under src/services/
• Signature key sourced from a pinned trust anchor

Suggested execution

• Fork the repo and create a branch
• git checkout -b feat/ofac-signed-source
• Implement changes
  • Add signature verifier
  • Pin parse-output hash per version
  • Emit sanctions.source.signature_failed alarm
• Validate security and correctness assumptions

Test and commit

• Run tests
  • npm test
• Cover edge cases
  • Tampered payload rejected without applying
• Include test output and notes

Example commit message

feat: signed OFAC source verification

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours