Repository navigation
fix(trace-adapters): validate timestamps/counts, require bool signature_verified, and reject private JWKs in build_record (#375) - #380
Conversation
…re_verified, and reject private JWKs in build_record (agentrust-io#375) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com>
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head ce90b47c25a0ab4ce60470557d4d59f941f91f9c in an isolated checkout.
The evidence/record builders now require literal boolean signature_verified, bounded integer timestamps/counts, public-only JWK inputs and integer ingestion times. The focused control passes here and fails with the baseline modules restored, including the package's public exports. All 128 adapter tests, pip check, the repository CI Ruff subset and diff whitespace checks passed in a fresh hash-locked adapter environment. This validates input/evidence handling, without independently certifying a source system's appraisal or provenance. No blocking finding in the changed paths; hosted checks and maintainer policy remain separate.
Reviewed with OpenAI Codex.
Closes #375
Summary
signature_verified is True, non-emptystrverifier/policy_ref, and positive RFC 8785 safeinttimestampinAppraisalEvidence.__post_init__.intingested_atinSourceSystem.__post_init__.iat(positive RFC 8785 safeint),tool_call_count(non-negative RFC 8785 safeint), and reject private/symmetric JWK parameters ("d","p","q","dp","dq","qi","oth","k") inbuild_record.packages/agentrust-trace-adapters/tests/test_appraisal.py.Validation
pytest packages/agentrust-trace-adapters/tests/test_appraisal.py packages/agentrust-trace-adapters/tests/test_builder.py -q— passed (34 passed)