Repository navigation
Conversation
…JSON keys in _receipt_verify.py (agentrust-io#367) - Enforce canonical unpadded 64-byte base64url in _receipt_verify._b64url_decode. - Reject duplicate JSON object keys, NaN/Infinity constants, and non-object canonical_payload values in _receipt_verify._verify. Closes agentrust-io#367 Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head 5506a7a6acc47b87758004899beb874f9c25c122 in an isolated checkout.
Reviewed canonical unpadded signature decoding/length, typed receipt fields, object-shaped canonical_payload and recursive duplicate/non-finite JSON rejection before trust is asserted. The explicitly trusted signed conformance fixtures remain valid and malformed/tampered/untrusted cases fail; default trust is not broadened. No blocking source finding in this scope.
Validation in the hash-locked Python 3.12.10 integration environment: all 24 mapping/trust tests passed; pip check, scoped Ruff and diff whitespace checks passed. Every PR commit has a sign-off. Hosted checks and the maintainer gate still need completion.
Reviewed with OpenAI Codex.
Summary
^[A-Za-z0-9_-]+$,len % 4 != 1, round-trip match) inintegrations/ramen-ai-cmcp/_receipt_verify.py(_b64url_decode).NaN/Infinityconstants, and non-objectcanonical_payloadvalues in_verify.Closes #367
Validation
python -m pytest integrations/ramen-ai-cmcp/tests/test_mapping.py -q