Skip to content

fix: distinguish missing and malformed signatures #390

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 2 commits into from
Sep 22, 2026
Merged

fix: distinguish missing and malformed signatures #390

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dafe67b
fix: distinguish missing and malformed signatures
imran-siddique Sep 21, 2026
4e6cfd1
Merge main and preserve signature and nonce regression tests
imran-siddique Sep 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions src/agentrust_trace/sign.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -674,11 +674,10 @@ def verify_record(
"signature over semantics this build does not implement is not evidence."
)

sig_b64 = record.get("signature")
if not sig_b64:
if "signature" not in record:
raise ValueError("record has no 'signature' field")

sig_bytes = _b64url_decode(sig_b64, field="signature")
sig_bytes = _b64url_decode(record["signature"], field="signature")

# Signature validity is not schema validity. Enforce the canonical profile
# shape here so callers cannot accidentally treat a signed object carrying
Expand Down
17 changes: 17 additions & 0 deletions tests/test_sign.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1189,6 +1189,23 @@ def test_the_guards_do_not_refuse_what_they_should_accept():
verify_record(record, key_to_jwk(key))


@pytest.mark.parametrize("value", [None, 0, False, [], {}, 1, True, [0], {"a": 1}])
def test_present_non_string_signature_reports_wrong_type(value):
key = generate_key()
record = sign_record(_fresh_record(), key)
record["signature"] = value
with pytest.raises(ValueError, match="^signature must be a base64url string$"):
verify_record(record, key_to_jwk(key), now=record["iat"])


def test_present_empty_signature_is_invalid_not_missing():
key = generate_key()
record = sign_record(_fresh_record(), key)
record["signature"] = ""
with pytest.raises(ValueError, match="does not conform.*signature"):
verify_record(record, key_to_jwk(key), now=record["iat"])


@pytest.mark.parametrize("nonce", ["abc123", "n\u00f8nce", "\U0001f512"])
def test_verify_record_nonce_unicode_match(nonce):
key = generate_key()
Expand Down
Loading