Repository navigation
conformance: v0.3 draft fixtures for the manifest reference (#483) - #487
Merged
imran-siddique merged 1 commit intoOct 12, 2026
Conversation
…t-io#483) Six fixtures for the optional signed manifest {id, digest, media_type}: digest match, mismatch, mismatch with a signed producer-asserted result, unresolvable (not a pass, record not rejected), manifest added after signing, and a no-manifest control. The draft rule is stated as a reference checker in the test; four wrong checkers are each caught. Signed with the repo's rfc8785 dependency; records are byte-identical to babyblueviper1/preaction-governance-conformance@2cd4ae7. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: babyblueviper1 <babyblueviperbusiness@gmail.com>
babyblueviper1
requested review from
a team,
lywinged and
rajnisht7
as code owners
October 12, 2026 18:12
Contributor
|
🔴 Contributor Check: HIGH
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:HIGH
imran-siddique
approved these changes
Oct 12, 2026
imran-siddique
left a comment
imran-siddique
left a comment
Member
There was a problem hiding this comment.
Matches #483: the six cases, the repo's rfc8785, no CHANGELOG hunk, and every wrong checker caught. Non-blocking: VECTORS loads with a bare p.read_text(), so on Windows the default cp1252 decoding breaks test_fixtures_are_reproducible while CI on Linux passes. read_text(encoding="utf-8") fixes it here, or #484's sweep will pick it up.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
v0.3 draft fixtures for the manifest reference proposed in #483, as agreed there.
conformance/tests/vectors/manifest-ref-v0.3-draft/: six fixtures,generate.py, README.manifest_verification_result: verifiedmanifest-unresolved, not a pass, and the record still verifiesmanifestadded after signing: the signature fails firstmanifestconformance/tests/test_manifest_ref_draft_vectors.py: no module implements the reference yet, so the test states the draft rule as a small reference checker. The signature is checked first, then the digest is recomputed over the resolved bytes, and the asserted result is never read. Four wrong checkers are each caught by at least one fixture, and the generator reproduces the fixtures.Signing uses the repo's
rfc8785dependency; nothing is vendored.CHANGELOG.mdis untouched. The records are byte-identical to the vectors first posted on #483 (preaction-governance-conformance@2cd4ae7).Local:
pytest tests/test_manifest_ref_draft_vectors.py12 passed; full conformance suite 718 passed, 5 xpassed;ruff checkandruff format --checkclean. DCO signed off.Type of change
Spec section
None changed. The fixtures exercise §3.2.2 (embedded signature over RFC 8785), §3.3 step 1 (signature before any field is trusted) and the §3.1.2 rule 3 posture for unresolvable pointers, applied to the
manifestobject proposed for v0.3 in #483.Tests for a fix
Not a code or schema fix.
Checklist
git commit -s)CHANGELOG.mdupdated (for any normative change): left out as agreed on v0.3: let a record name the agent manifest it ran under #483, the entry is written at merge<!-- CHANGED: #NNN: description -->in spec text (none)