validate checksum - #1
Merged
Merged
Conversation
…tion - Enforce algorithm:digest format for checksum qualifiers with strict length and hex validation - Add error codes E_CHECKSUM_MISSING_ALGORITHM and E_CHECKSUM_INVALID_DIGEST_FOR_ALGORITHM - Generate and check type rules from specification/types/*-definition.json - Add scripts: generate-type-rules.mjs, check-generated-type-rules.mjs, dump-qualifier-policy.mjs - Add tests for qualifier policy coverage and generated type rules runtime - Update fuzz and adversarial tests to cover checksum validation - Document strict checksum mismatches and qualifier policy audit - Update package.json files list and README badges - Refactor qualifier policy logic for compatibility overrides Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
…PI mixed dot/underscore normalization; document normalization opcodes Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
There was a problem hiding this comment.
Pull request overview
This PR tightens strict validation around checksum qualifiers and moves type-rule data from runtime-loaded JSON to a generated generated/type-rules.js artifact, with accompanying generator/check scripts and expanded test coverage.
Changes:
- Add strict checksum validation (
algorithm:digest, expected hex length per algorithm) in parse/build flows and update fixtures/tests accordingly. - Generate and ship type rules (
generated/type-rules.js) fromspecification/types/*-definition.json, with CI freshness checks and runtime smoke tests. - Add qualifier allow-list introspection (
getAllowedQualifierKeysForType) plus new policy/fuzz tests to prevent validation bypasses.
Reviewed changes
Copilot reviewed 20 out of 21 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| test/support/type-test-utils.js | Updates default checksum test value to a valid-length sha256 digest. |
| test/strict-encoding-edge-cases.test.js | Switches unicode-percent-triplet normalization test away from checksum (now strictly validated). |
| test/qualifier-policy-coverage.test.js | Adds coverage to ensure allow-lists match spec definitions and compat exceptions. |
| test/mutation-type-rules-negative.test.js | Updates checksum default to meet new digest validation requirements. |
| test/generated-type-rules-runtime.test.js | Verifies generated rules match spec and runtime works with only index.js + generated rules. |
| test/fuzz-typed-deterministic.test.js | Expands typed fuzzing to generate valid checksums and assert rejections for invalid payloads. |
| test/fuzz-roundtrip-deterministic.test.js | Expands roundtrip fuzzing similarly and adds checksum-mutation rejection tests. |
| test/fixtures-base.test.js | Extends “expected strict failures” detection to treat invalid checksum fixtures as strict failures; refactors compat qualifier map. |
| test/adversarial-type-policy.test.js | Adds adversarial tests ensuring checksum validation is enforced across all registered types. |
| test/advanced-generated-matrix.test.js | Extends generated matrix tests to include checksum validation failures. |
| specification/tests/STRICT_CHECKSUM_MISMATCHES.md | Adds a ledger for fixture cases that don’t satisfy strict checksum validation. |
| scripts/generate-type-rules.mjs | Adds generator to compile spec type definitions into a deterministic JS module. |
| scripts/dump-qualifier-policy.mjs | Adds a script to dump the effective qualifier allow-list per type. |
| scripts/check-generated-type-rules.mjs | Adds a script to fail CI if generated/type-rules.js is stale/missing. |
| package.json | Ensures generated rules are included in the published package via the files list. |
| index.js | Switches to generated rule source, adds normalization opcode execution, qualifier policy building, and strict checksum validation. |
| generated/type-rules.js | Adds the generated type-rule source module consumed at runtime. |
| README.md | Documents generated type rules, checksum validation behavior, and normalization opcode model/limitations. |
| AI-DECLARATION.md | Adds an AI declaration document. |
| AGENTS.md | Updates contributor/agent workflow to include regeneration and freshness checks. |
| .github/workflows/ci.yml | Adds CI step to verify generated/type-rules.js freshness. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.