Repository navigation
fix(xchk-registry): reject private JWK members, non-canonical base64url, boolean Instant(now), and duplicate JSON keys (#378) - #383
Conversation
…rl, boolean Instant(now), and duplicate JSON keys (agentrust-io#378) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com>
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head 9de214b1b0976b2debd3b089a22c90a900601ce9 in an isolated checkout.
The registry consumer refuses private/symmetric JWK material, noncanonical key encodings, invalid explicit verification times and ambiguous local/published-key JSON. Its existing pinned-key trust boundary and historical-time reporting remain intact. All 27 offline tests pass; the live-registry test is intentionally skipped. The focused rejection control fails against the actual baseline module. pip check, repository CI Ruff and diff whitespace checks pass in the hash-locked environment. No live registry availability or new tier/conformance claim is made; hosted checks and maintainer policy remain separate.
Reviewed with OpenAI Codex.
Closes #378
Summary
"d","p","q","dp","dq","qi","oth","k") and enforce canonical unpadded 32-byte base64url inis_ed25519_jwkand canonical base64 inkey_from_published.nowinInstant.__init__.NaN/Infinityrejection inload_jsonandpublished_key.integrations/xchk-registry/tests/test_trust_record.py.Validation
pytest integrations/xchk-registry/tests/test_trust_record.py -q— passed