From 505dd05dd0925131233910d320bf1568680adc87 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Fri, 25 Sep 2026 21:59:16 -0700 Subject: [PATCH] chore(release): 0.6.1 Bump agentrust-trace-tests to 0.6.1 and close the changelog over #124 and #125. Duplicate member names are now refused at load and TR-SIG accepts only unpadded base64url, so records that passed on 0.6.0 can fail on 0.6.1; the changelog says so under Changed. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 50 ++++++++++++++++++++++++++++++++++---------------- index.md | 4 ++-- pyproject.toml | 2 +- 3 files changed, 37 insertions(+), 19 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f205459..6b6a120 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,30 +2,48 @@ ## Unreleased -### Fixed +## v0.6.1 - 2026-09-26 + +### Changed -- TR-SIG decodes `signature` and `cnf.jwk.x` as unpadded base64url in its one - canonical spelling. The standard alphabet, padding, characters outside the - alphabet and nonzero trailing bits were all accepted before, and since the - signature sits outside the body it signs, each was a different record that - still verified. -- Records, anchor receipts and policy manifests with duplicate member names are - refused at load (exit 2). `json.loads` kept the last value, the signature was - checked over it, and a consumer whose parser keeps the first read a value no - signature covered. RFC 8785 is defined over I-JSON, which forbids duplicates. -- Digest, `subject` and receipt hash checks use `fullmatch`. Python's `$` - matched before a trailing newline, so `sha256:<64 hex>\n` passed TR-RTE-002, - TR-SCA-002, TR-TXN-001, TR-POL-001 and TR-ENV-003. +Each change here refuses input that 0.6.0 accepted, so a record that passed on +0.6.0 can fail on 0.6.1. The first two are the ones producers will hit. + +- **Duplicate member names are refused at load (exit 2) (#124).** This covers + records, anchor receipts and policy manifests. `json.loads` kept the last + value, the signature was checked over it, and a consumer whose parser keeps + the first read a value no signature covered. RFC 8785 is defined over + I-JSON, which forbids duplicates. A producer that emits a repeated key now + gets a load error instead of a report. +- **TR-SIG accepts one spelling of `signature` and `cnf.jwk.x` (#124):** + unpadded base64url. The standard alphabet, `=` padding, characters outside + the alphabet and nonzero trailing bits were all accepted before, and since + the signature sits outside the body it signs, each was a different record + that still verified. A record signed with padded or standard base64 now + fails TR-SIG. +- Digest, `subject` and receipt hash checks use `fullmatch` (#124). Python's + `$` matched before a trailing newline, so `sha256:<64 hex> +` passed + TR-RTE-002, TR-SCA-002, TR-TXN-001, TR-POL-001 and TR-ENV-003. - TR-ANC-002 refuses claims outside the anchor-leaf profile of registry-anchor-v1 section 1: non-integer numbers and integers outside the - safe range, whose leaf bytes differ between implementations. -- Untrusted input no longer reaches the CLI as a traceback: a non-ASCII + safe range, whose leaf bytes differ between implementations (#124). + +### Fixed + +- Untrusted input no longer reaches the CLI as a traceback (#124): a non-ASCII `runtime.nonce` (`TypeError` from `hmac.compare_digest`), a lone surrogate in an object key (`UnicodeEncodeError` from `rfc8785`), a non-string `transparency` in `report --html`, and non-UTF-8, over-deep or unreadable input files. Each is now a finding or a load error. + +### Internal + - ClusterFuzzLite targets over the record loader and every module, the - signature path and the anchor receipt, run on pull requests and nightly. + signature path and the anchor receipt, run on pull requests and nightly + (#124). +- The maintainer approval gate drops the unused `statuses: write` scope and + runs with `contents: read` and `pull-requests: read` (#125). ## v0.6.0 - 2026-09-25 diff --git a/index.md b/index.md index 70a0294..6e0326f 100644 --- a/index.md +++ b/index.md @@ -16,7 +16,7 @@ The suite checks one record and the evidence supplied with it, reports the highe [What this proves, and what it does not](LIMITATIONS.md){ .md-button } !!! tip "TL;DR" - [agentrust-trace-tests](https://pypi.org/project/agentrust-trace-tests/) 0.6.0 (Apache-2.0) runs eight modules against a record on your machine and writes a report carrying the record digest, the suite version and the command to reproduce it. A pass describes the record and says nothing about the agent, and TR-RTE checks the shape of attestation fields without verifying a quote against AMD or Intel roots. + [agentrust-trace-tests](https://pypi.org/project/agentrust-trace-tests/) 0.6.1 (Apache-2.0) runs eight modules against a record on your machine and writes a report carrying the record digest, the suite version and the command to reproduce it. A pass describes the record and says nothing about the agent, and TR-RTE checks the shape of attestation fields without verifying a quote against AMD or Intel roots.
@@ -104,4 +104,4 @@ A conformance report that looks authoritative and cannot be checked is the same The suite tracks [TRACE Spec v0.2](https://trace.agentrust-io.com). See [Changelog](CHANGELOG.md) for what moved between suite versions. -**Status:** agentrust-trace-tests 0.6.0 · Apache-2.0 · tracks TRACE Spec v0.2 · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects. +**Status:** agentrust-trace-tests 0.6.1 · Apache-2.0 · tracks TRACE Spec v0.2 · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects. diff --git a/pyproject.toml b/pyproject.toml index be9a530..25a7343 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "agentrust-trace-tests" -version = "0.6.0" +version = "0.6.1" description = "TRACE conformance test suite" readme = "README.md" license = { text = "Apache-2.0" }