From 7592a0cc2893ae5ce9341b63f2ef7de6d077d946 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 03:24:33 +0000 Subject: [PATCH 1/2] changelog: add the entries for three pull requests merged on 27 October They merged after changelog entries moved to main at merge, and no entry was written for them then. The collateral and Acta receipt verifier entries are their author's own, as they stood in those pull requests before the file was taken out of them; the code they describe did not change after. The adapters entry is new and was checked against the merged code. Signed-off-by: Louie Lu <48041247+lywinged@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UtTRZHH7SXtpEikWace636 --- CHANGELOG.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a5692ef9..46f50ca3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,43 @@ Format: [Semantic Versioning](https://semver.org/). Spec versions follow `MAJOR. ## [Unreleased] +- **The AGT and sandbox adapters validate `data_class`, string and URI fields, and the + policy and appraisal enums, when they are constructed and again in + `build_trust_record`.** `data_class`, `model_provider` and `model_id`, and when given + `model_version`, `build_provenance_builder` and the sandbox adapter's + `policy_version`, must be non-empty strings without lone surrogates, raising + `ValueError`, and the agent DID and sandbox ID checks refuse lone surrogates too; + `SandboxAttestation` holds its `firmware_version` and `nonce` to the same rule. An + invalid `enforcement_mode` or `appraisal_status`, and in the sandbox adapter an + invalid `build_provenance_slsa_level`, now raises `pydantic.ValidationError` from the + constructor instead of from `build_trust_record`, which repeats the adapter's checks, + so a value changed after construction is still refused. `transparency`, + `appraisal_verifier` (required), `appraisal_policy_ref`, `build_provenance_uri`, the + sandbox adapter's `policy_uri` and `SandboxAttestation.rim_uri` must be RFC 3986 URIs + by the check `validate.is_uri` makes, and must encode as UTF-8 (#615, #619, by + @drk-ram). + +- **`tdx_collateral` and `snp_collateral`: TCB status validation, minimal DER integer + decoding, and policy input validation.** `tdx_collateral._converge` now validates both + `platform` and `other` against `_STATUS_TO_QV` while preserving Intel DCAP QVL's + `convergeTcbStatuses` (`EvaluateTcb.cpp:187-225` at `d12717e3`) convergence semantics, + and `tdx_collateral` rejects non-minimal DER length and integer encodings in PCK SGX + extensions. `snp_collateral._der_uint` now rejects negative, non-minimal, and + out-of-range (`> 255`) DER integers in VCEK TCB extensions, and `TcbFloor`, + `CollateralPolicy`, `appraise_collateral`, and `tcb_component` validate their input + types and fail closed with `CollateralDenied` (#603, #610, by @drk-ram; review by + @dinakarjs and @lywinged). + +- **Acta receipt verifier: JWK, signature hex, and JSON input hardening.** + `tools/acta_receipt_verifier.py` now rejects JWKs carrying private or symmetric key + parameters (`d`, `p`, `q`, `dp`, `dq`, `qi`, `oth`, `k`) or non-canonical unpadded + base64url `x` values in `issuer_key` (`malformed_key_set`), requires `signature.sig` + in `signature_verifies` to be 128 lowercase hex characters without whitespace + (`signature_invalid`), rejects duplicate JSON object keys and catches `RecursionError` + in `_read_json` (`malformed`), and handles uncanonicalizable or deeply nested payloads + and predecessors in `signature_verifies` and `chain_link_matches` (#605, #608, by + @drk-ram). + - **`prototype.gate_store` and `prototype.cmcp_gate`: binary store secrets, canonical base64url/JSON frames, `GateStoreUnavailable` response wrapping, and `CMCPTraceGate` entry checks.** `GateStoreServer` and `RemoteGateStore` now both require a `bytes` From 9eb2087387333e3d29ae7cc65d95e220f3897c3a Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 06:06:26 +0000 Subject: [PATCH 2/2] changelog: narrow two clauses to what the code changed appraisal_verifier is never None, but both adapters give it a default, so it is not required. And before the Acta receipt verifier change, signature_verifies already returned False for a payload rfc8785 cannot canonicalize: rfc8785's errors and UnicodeEncodeError are all ValueErrors, which it caught. What that change added there is deep nesting; chain_link_matches had no handling before it. The collateral entry stays its author's own as it stood in its pull request. The Acta receipt verifier entry is its author's, with its pull request added to the credit and its last clause narrowed to what it changed. Signed-off-by: Louie Lu <48041247+lywinged@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UtTRZHH7SXtpEikWace636 --- CHANGELOG.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 46f50ca3..0e5f0245 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,9 +22,9 @@ Format: [Semantic Versioning](https://semver.org/). Spec versions follow `MAJOR. invalid `build_provenance_slsa_level`, now raises `pydantic.ValidationError` from the constructor instead of from `build_trust_record`, which repeats the adapter's checks, so a value changed after construction is still refused. `transparency`, - `appraisal_verifier` (required), `appraisal_policy_ref`, `build_provenance_uri`, the - sandbox adapter's `policy_uri` and `SandboxAttestation.rim_uri` must be RFC 3986 URIs - by the check `validate.is_uri` makes, and must encode as UTF-8 (#615, #619, by + `appraisal_verifier` (never `None`), `appraisal_policy_ref`, `build_provenance_uri`, + the sandbox adapter's `policy_uri` and `SandboxAttestation.rim_uri` must be RFC 3986 + URIs by the check `validate.is_uri` makes, and must encode as UTF-8 (#615, #619, by @drk-ram). - **`tdx_collateral` and `snp_collateral`: TCB status validation, minimal DER integer @@ -44,9 +44,9 @@ Format: [Semantic Versioning](https://semver.org/). Spec versions follow `MAJOR. base64url `x` values in `issuer_key` (`malformed_key_set`), requires `signature.sig` in `signature_verifies` to be 128 lowercase hex characters without whitespace (`signature_invalid`), rejects duplicate JSON object keys and catches `RecursionError` - in `_read_json` (`malformed`), and handles uncanonicalizable or deeply nested payloads - and predecessors in `signature_verifies` and `chain_link_matches` (#605, #608, by - @drk-ram). + in `_read_json` (`malformed`), and handles deeply nested payloads in + `signature_verifies` and uncanonicalizable or deeply nested predecessors in + `chain_link_matches` (#605, #608, by @drk-ram). - **`prototype.gate_store` and `prototype.cmcp_gate`: binary store secrets, canonical base64url/JSON frames, `GateStoreUnavailable` response wrapping, and `CMCPTraceGate`