Repository navigation
fix(trace-adapters): reject boolean capture timestamps and non-canonical base64 signatures in openshell adapters (#368) - #371
Conversation
…cal base64 signatures in openshell adapters (agentrust-io#368) - Require boolean capture_complete and integer 0 <= capture_start <= capture_end <= 2**53 - 1 in openshell.build_transcript. - Require canonical 64-byte base64 signatures in openshell_bundle.verify_bundle. Closes agentrust-io#368 Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head 33b576b6aea9dee9efd2255cc8f56ba9107470cb in an isolated checkout.
Capture completeness now requires literal true and timestamps require ordered, bounded integers rather than booleans. I also exercised a genuinely signed bundle: the original signature verifies; changing only unused base64 pad bits preserves its decoded bytes but is rejected by this head. Restoring the actual merge-base bundle verifier accepts that same alias, so the canonicality check is independently exercised rather than masked by a bad signature.
Validation in the hash-locked Python 3.12.10 adapter environment: 128 adapter tests plus the OpenShell integration test passed; pip check and scoped Ruff passed. Sign-offs are present. Please trim the extra blank line at test_openshell_bundle.py EOF. No blocking source finding; hosted checks and maintainer policy remain separate.
Reviewed with OpenAI Codex.
Summary
type(capture_complete) is boolandtype(capture_start) is int,type(capture_end) is int, and0 <= capture_start <= capture_end <= 2**53 - 1inpackages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell.py(build_transcript).len(signed) == 64andbase64.b64encode(signed).decode("ascii") == encodedinpackages/agentrust-trace-adapters/src/agentrust_trace_adapters/openshell_bundle.py(verify_bundle).Closes #368
Validation
python -m pytest packages/agentrust-trace-adapters/tests/test_openshell_bundle.py packages/agentrust-trace-adapters/tests/test_openshell.py -q