Repository navigation
test: the shared revocation-statement table, run by all four bindings - #671
Merged
Merged
Conversation
The table pins rule 5 of "Build-level revocation" (superseded_by, class, summary and revoked_at must be strings; "" means no fix) and that the first verifying revocation in a listing wins, with one warning per ignored candidate before it. Each binding reads tests/fixtures/revocation-statement (generated by the delivery side's registry tests, copied byte for byte) and runs the 10 statement rows through its revocation-verify function and the 6 listing rows through its real candidate loop against a local registry. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The public lint reads any chtypes-<letter> token as a private sibling repository's name; the TS test's temp-dir prefix was one. It now follows the other TS tests' prefixes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The delivery side's generated table gains sixteen-invalid-then-valid: 16 distinct non-verifying statements, then a valid one. A client reads at most 16 revocation referrers per manifest (MAX_REFERRERS), so it fails open and the 17th is dropped without a warning; the registry refuses to accept a 17th revocation for a manifest, so the state is unreachable in service. Copied byte-for-byte; every file checks against SHA256SUMS. Go (7/7 listings) and Python (18 tests) pass locally against it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
tests/fixtures/revocation-statement/(copied byte for byte,SHA256SUMSverified; generated by the delivery side's registry tests, which run the same file) and a test in each binding that reads it.The contract rule
docs/guides/fetch-v1.md, "Build-level revocation", rule 5:predicate.advisoryhas non-empty stringidandurl, andclass,summary,superseded_byandrevoked_atare strings; "no fix" issuperseded_by: "". Anything else means the candidate is ignored with one warning naming it, and the first candidate in the listing that verifies wins. All four bindings already implement this; no conformance case covered a non-string field or a valid candidate after invalid ones. No production code changes.The cases
superseded-by-emptyandsuperseded-by-buildverify (the six parsed strings must equalexpect_advisory; the revoked message omits "; superseded by build ..." exactly when there is no fix);superseded-by-null,-number,-missing,class-number,summary-null,revoked-at-number,other-keyandmanifest-mismatchare refused.invalid-then-valid,valid-then-invalid,valid-only,invalid-only,two-invalid-then-valid,two-valid): served from a local registry in listing order through each binding's real candidate loop; the result isCHTYPES_ARTIFACT_REVOKEDcarrying the winning advisory, or fail-open with one "does not verify and is ignored" warning per ignored entry.Each test skips loudly when the table is absent and refuses a table with no rows. Go and Python were run locally and fail when the string check is removed; TypeScript and Rust are verified in CI.
docs/guides/fetch-v1.mdnames the table; each CHANGELOG has one bullet under Added.Update: the table now also has
sixteen-invalid-then-valid: 16 non-verifying statements, then a valid one. A client reads at most 16 revocation referrers per manifest (MAX_REFERRERS), so it fails open, and the 17th is dropped without a warning. The registry refuses to accept a 17th revocation for a manifest, so that state can't arise in service. Copied byte-for-byte, and every file checks againstSHA256SUMS. Go (7/7 listings) and Python (18 tests) pass locally. A TS test's temp-dir prefix was renamed to match the other TS tests.🤖 Generated with Claude Code