[drk-ram]

What

Reject duplicate alg_id declarations, zero or mismatched digest_size values for known algorithms (ALG_SHA1, ALG_SHA256, ALG_SHA384, ALG_SHA512), and trailing bytes after vendorInfo in _parse_spec_id, and reject duplicate alg_id entries per event and non-bytes input in parse_event_log.

Why

Closes #812.

Security impact

Prevents a crafted TCG Spec ID header from declaring truncated digest sizes (e.g., 4-byte SHA-256) or duplicate algorithm entries that overwrite earlier PCR event digests during replay.

Test plan

• pytest passes (pytest tests/unit/test_tcg_event_log.py -q: 15 passed)
• ruff check passes (All checks passed!)
• mypy passes
• Manual test performed

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[noah-ing]

Reviewed exact head e095d18 against #812. Independent synthetic TCG event-log controls confirm that duplicate Spec ID algorithms, zero or wrong digest sizes, inconsistent or truncated vendorInfo, and duplicate EVENT2 digests are rejected; valid logs, including nonempty vendorInfo, continue to parse and replay. The 15 focused tests passed, as did the full unit suite (2,530 passed, 20 skipped), touched-file lint, and type checking.

I found no blocking issue in this PR's scope and approve the change. The controls were synthetic; normal hosted checks and maintainer approval still apply.

[carloshvp]

Reviewed exact head e095d18a6c2afd1055a4872782df884b93a1a95c in an isolated checkout.

The parser rejects duplicate algorithm declarations/digests, incorrect known digest widths and Spec ID vendor-info framing errors, while retaining supported valid event logs. All five focused malformed-log cases pass at this head; four rejection assertions fail when the actual baseline parser is restored in process. No blocking finding in the changed parsing/replay boundary.

Independent validation in a fresh repository-hash-locked Python 3.12.10 environment: 2,530 tests passed, 20 skipped; pip check, configured Ruff, mypy, Bandit and diff whitespace checks passed. Commit sign-offs are present. Hosted CI and applicable independent maintainer/security gates remain separate prerequisites to merge.

Reviewed with OpenAI Codex.