Repository navigation
id(artifact): validate known-kind bodies in SignedArtifact::sign / sign_after (#5623) - #6240
Merged
Merged
Conversation
![developing-today[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…gn_after (#5623) Construction-vs-receipt symmetry: sign_after now runs the receipt check (SignedArtifact::parsed) on the artifact it is about to return, so the generic signing helpers and ArtifactLog::sign refuse the same typed-body rules ArtifactLog::insert enforces — friend_remove signed by a non-party, oversize documents, malformed tags, home declarations for another account. Unknown kinds stay signable envelope-only and parsed() still returns None for them; failures stay Refusal::Forbidden, distinct from authenticity failures. Receipt-side tests that craft signed-but-refusable artifacts now build them through a #[cfg(test)] SignedArtifact::sign_unchecked (plus a typed sign_kind_unchecked helper), following the existing sign_raw_after precedent. New symmetry test signing_a_known_kind_refuses_the_bodies_receipt_refuses pins both sides for every known kind with parsed() as oracle.
developing-today
Bot
requested review from
a team and
dezren39
as code owners
November 5, 2026 14:00
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #5623. Queue task 10523.
What
Construction-vs-receipt symmetry for signed artifacts:
SignedArtifact::sign/sign_after(and with themArtifactLog::sign/sign_afterand the directory producers that route through them) now run the receipt check —SignedArtifact::parsed()— on the artifact before returning it. A direct caller can no longer obtain a signedfriend_remove,home_declared,document, ortagartifact thatparsed()/ArtifactLog::insertwould refuse.Refusal::Forbiddennaming the rule; authenticity failures stayRefusal::Unauthenticated— the classes do not blur.parsed()still returnsNone(forward compatibility preserved).#[cfg(test)] SignedArtifact::sign_unchecked(plus a typedsign_kind_uncheckedtest helper), following the existingsign_raw_afterprecedent — receipt refusal stays fully testable.signing_a_known_kind_refuses_the_bodies_receipt_refusespins the symmetry for every known kind, usingparsed()on a raw-signed copy as the oracle (per the repo testing doctrine: the oracle is named — it is the receipt check itself).Tests
On the laptop (CI-first note: run locally on amd-6, not the sandbox):
cargo test --lib artifact::— 38 passed, 0 failed.cargo test --lib(full id lib) — 2256 passed, 0 failed, 6 ignored.cargo fmt --checkreports pre-existing diffs across the repo with the installed rustfmt (untouched files included); no fmt changes were made.Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.