conformance: harden URI, explicit-null, and string-digest checks in TR-RTE, TR-ANC, TR-TXN, TR-SCA, and TR-POL #570

What is wrong

Contributor: Raghuvar Durga (@drk-ram)

On main (e1560f3), four conformance modules in conformance/src/trace_tests/modules/ have URI, explicit-null, and non-string digest coercion gaps that allow schema-invalid records to pass or skip conformance checks:

1. TR-RTE-003 (conformance/src/trace_tests/modules/tr_rte.py, lines 90-104):

   • Checks only if rim_uri is None: Status.SKIP and elif isinstance(rim_uri, str) and rim_uri.startswith("https://"): Status.PASS.
   • As a result:
     • Explicit {"rim_uri": None} (null in JSON, which fails schema/trace-claim.json because runtime.rim_uri is "type": "string") returns Status.SKIP instead of Status.FAIL (unlike TR-APR-003 and TR-APR-004, which fail on explicit null).
     • rim_uri = "https://" (empty authority/host), rim_uri = "https://ex ample.com/rim" (contains whitespace), rim_uri = "https://example.com/\x01" (contains control characters), and rim_uri = "https://[" (unparseable IPv6 host) all return Status.PASS!

2. TR-ANC-001 (conformance/src/trace_tests/modules/tr_anc.py, lines 21-42):

   • Uses urlparse(transparency) and checks only parsed.scheme != "https" or not parsed.netloc.
   • Because urllib.parse.urlparse does not reject whitespace or control characters, transparency = "https://rekor.sigstore.dev/api/v1/log/entries/bad uri" or "https://rekor.sigstore.dev/api/v1/log/entries/x\n" returns Status.PASS on TR-ANC-001 (whereas TR-POL-003 and TR-APR-002/003 explicitly reject whitespace and control characters).

3. TR-TXN-002 (conformance/src/trace_tests/modules/tr_txn.py, lines 31-34):

   • Checks call_count = txn.get("call_count"); if call_count is None: Status.SKIP.
   • When "call_count": null is explicitly present in tool_transcript ("call_count" in txn and txn["call_count"] is None), schema/trace-claim.json rejects it ("type": "integer"), but TR-TXN-002 returns Status.SKIP instead of Status.FAIL.

4. Non-string digest coercion via str(...) in TR-RTE-002, TR-SCA-002, TR-TXN-001, and TR-POL-001:

   • tr_rte.py (_DIGEST_RE.fullmatch(str(measurement))), tr_sca.py (_DIGEST_RE.fullmatch(str(digest))), tr_txn.py (_DIGEST_RE.fullmatch(str(h))), and tr_pol.py (_DIGEST_RE.fullmatch(str(bundle_hash))) coerce non-strings via str(...) before matching _DIGEST_RE, instead of requiring isinstance(..., str).

Spec section or file

• conformance/src/trace_tests/modules/tr_rte.py (TR-RTE-002, TR-RTE-003)
• conformance/src/trace_tests/modules/tr_anc.py (TR-ANC-001)
• conformance/src/trace_tests/modules/tr_txn.py (TR-TXN-001, TR-TXN-002)
• conformance/src/trace_tests/modules/tr_sca.py (TR-SCA-002)
• conformance/src/trace_tests/modules/tr_pol.py (TR-POL-001)

Expected behavior

1. TR-RTE-003 should skip only when "rim_uri" not in runtime, fail when rim_uri is None or not a str, and require a valid https URI with non-empty host (netloc) and no whitespace or control characters.
2. TR-ANC-001 should reject transparency URIs containing whitespace or control characters with Status.FAIL.
3. TR-TXN-002 should skip only when "call_count" not in txn, and fail with Status.FAIL when "call_count" is explicitly None.
4. TR-RTE-002, TR-SCA-002, TR-TXN-001, and TR-POL-001 should require isinstance(value, str) before matching _DIGEST_RE.

Impact

Prevents trace-tests from passing malformed runtime.rim_uri ("https://" or URIs with spaces/control characters) and transparency URIs with spaces/control characters, or skipping explicit null values on runtime.rim_uri and tool_transcript.call_count.