Repository navigation
fix(parmana-server): enforce canonical 64-byte base64 signatures and guard non-dict fields in parmana_evidence (#377) - #382
Conversation
…guard non-dict fields in parmana_evidence (agentrust-io#377) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com>
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head 31107bc8976edafe276c3215ec0b37e179892670 in an isolated checkout.
The approval/refusal helpers reject noncanonical or wrong-length standard-base64 signatures and malformed containers while preserving the signed fixture controls. All 23 offline integration tests pass. The five focused rejection controls fail with the baseline module restored in process. I used a fresh hash-locked review environment resolved from the integration's declared test dependencies, including parmana 1.6.0; pip check, repository CI Ruff and diff whitespace checks pass. This is fixture/signature verification rather than a new Parmana execution or observed downstream effect. No blocking source finding; hosted checks and maintainer policy remain separate.
Reviewed with OpenAI Codex.
Closes #377
Summary
base64.b64decode(..., validate=True), 64-byte signature length, and canonical base64 round-trip equality inparmana_evidence._verify, returningFalseon malformed base64 instead of raisingbinascii.Error.signature,payload, andissuerfields inverify_refusal_recordandverify_approval.integrations/parmana-server/tests/test_parmana_evidence.py.Validation
pytest integrations/parmana-server/tests/test_parmana_evidence.py -q— passed