Independently verify real Git pack and index bytes

[omar07ibrahim]

What changed

• build a real Git pack/index pair from three deterministic synthetic blobs with isolated git pack-objects
• independently parse pack v2 entry headers, bounded zlib streams, logical object IDs, CRC32 values, and the pack trailer
• independently parse index v2 fanout, sorted object IDs, CRC32 rows, 32/64-bit offsets, pack binding, and the index checksum
• cross-check every index row against the decoded pack
• expose production pack-verify and pack-inspect CLI paths
• add adversarial parser, runtime, CLI, file-boundary, evidence, and provenance tests
• add immutable, least-privilege CodeQL analysis with security-extended queries

Honest, reproducible evidence

The production receipt drives four accessible SVGs, exact compact/pretty/CLI captures, an offline report, and a real 1440×1500 digest-pinned Chromium screenshot. The screenshot SHA-256 is ad1f615da03d2e0570a4b3b26603c310058964bfbc5dda201d176de8107e4d63; the report receipt is a884aed43dbb027559f6df78ff727863b9b52b145ffb719756b2302a490a81b0.

Every pack visual names evidence/git-pack-index-v1.json in machine-readable metadata and is bound by the pack manifest. Capture used a read-only container with no network, all capabilities dropped, and no host or personal data. The original DAG evidence remains current; its source manifest was regenerated rather than abandoned.

Closed subset and non-claims

This increment accepts pack v2/index v2 only, at most 64 objects, 1 MiB input files, 256 KiB expanded objects, static non-delta entries, and SHA-1 object format. It rejects OFS/REF deltas, malformed zlib streams, unsafe files, checksum/fanout/offset drift, duplicate logical objects, and unsupported formats.

The fixture is exactly three authored synthetic blobs. It does not claim arbitrary-repository support, reachability analysis, pack optimization, authentication, signatures, collision-resistant security, or network execution.

Exact verification

Exact head: f9bcf2fb3d49539132700873a2aa97591b7bc8b5.

• CI run 31313757140: 89/89 tests; both evidence packages reproduced; ShellCheck 0.9.0; sdist and wheel built; the installed wheel reproduced both CLI receipts.
• CodeQL run 31313757180: Python security-extended, 50 rules, 0 results and 0 open alerts.
• Dependabot open alerts: 0. Secret-scanning open alerts: 0.
• Twelve linear commits from the prior main; every author and committer is Omar Ibrahim. No force update, squash, amend, co-author, or merge commit was used.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.