Skip to content

trace-verify 0.4.2

Choose a tag to compare

View all tags
@imran-siddique imran-siddique released this 26 Sep 21:27
v0.4.2
4ae8c49
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

pip install trace-verify==0.4.2

Behaviour changes

  • Key rotation is now refused. trace-verify chain fails a link whose key_id differs from the previous checkpoint's. Each checkpoint names its own key, so a chain that changed signers midway used to verify clean. The chain format has no rotation statement, so a checkpoint signed by a new key is a break, not a continuation: there is no supported way to rotate the checkpoint key and keep a chain verifying. The anchor pipeline also refuses to extend a published chain when its configured signing key is not the one that signed the last checkpoint.
  • trace-verify chain with no checkpoints exits 1 (#88). It exited 0 and, with --json, reported verified: true for input containing no checkpoint. It now prints NOT VERIFIED, and --json reports verified: false, checkpoints: 0, reason: "no_checkpoints".
  • Malformed input fails instead of raising (#94). CheckpointRecord.from_dict raises ValueError for a missing or mistyped member (it raised KeyError or TypeError) and refuses a boolean, float or numeric-string integer. verify_checkpoint_link returns a failure for a non-string root. InclusionProof.from_dict and ConsistencyProof.from_dict raise InvalidArgumentError. A non-string canonicalization_id is an UnknownCanonicalizationError. The CLI exits 2 for a file that is not UTF-8 or is nested too deeply, and chain reports a malformed checkpoint as a failure; both printed tracebacks. Found by the new ClusterFuzzLite targets in .clusterfuzzlite/.

Fixes

  • trace-verify --json prints one JSON document when the signature does not verify. It printed two (#93).
  • trace-verify --entry-url follows a redirect only to an allowlisted https host. The allowlist was checked on the first URL only, and urllib followed any redirect after it (#93).

Registry side (not in the package)

  • The pipeline, the aggregator and tools/anchor.py refuse a claim outside the registry-anchor-v1 section 1 profile: a non-integer number, an integer outside -(2^53-1)..2^53-1, or a duplicate member name. Every claim already anchored is inside the profile (#93).
  • A staged record whose producer is an array or object is rejected by name. It used to abort the scheduled run for every producer. CI now dry-runs staged records (#93).
  • tools/check_append_only.py diffs with --no-renames and fails when the base SHA does not resolve (#93).
  • The aggregator caps request bodies at 4 MiB (413), answers a missing, negative or malformed Content-Length with 400, and answers 400 to a body nested too deeply to parse (#93, #94).
  • tools/capture_witness_receipt.py --registry-entry lifts the mmr_checkpoint out of a registry entry file, with --batch-id for a multi-line file (#78).
  • CI: ruff (#96), per-job write permissions (#95), pipeline runtime dependencies (#89), maintainer approval check (#92).

Full list in CHANGELOG.md.

Assets 2
Loading