feat: packed-consumer verification lane and MaxPlaintextBytes - #85
Merged
systemslibrarian merged 1 commit intoSep 5, 2026
Merged
Conversation
Packed-consumer verification (scripts/verify-packed-consumers.sh + workflow): packs all nine lockstep packages into a hermetic local feed (prerelease-suffixed version + isolated NUGET_PACKAGES, so the published version in any cache can never shadow the fresh pack), builds a clean net8.0+net10.0 consumer from the packages alone, asserts the packed analyzer loads and fires (PQFE101), runs the full API journey on both frameworks (passphrase/hybrid/PQKF/fingerprint/ sign+tamper-reject/DI), and installs + drives the packed pqfe tool end to end including recipient flow and the documented exit-code contract. Verified green locally on both TFMs. OSS-Fuzz build.sh now builds and seeds decrypt_hybrid. PqDecryptionLimits.MaxPlaintextBytes: total-plaintext ceiling enforced BEFORE any key derivation for every known-length input — the exact plaintext total is derived from the container length (a safe upper bound even for short-frame leniency containers) and over-limit containers reject with PqFormatException. Closes the size-amplification hole for services buffering untrusted containers (external review Medium). Default unlimited: zero acceptance change; the shared gate serves core and Hybrid decryptors alike. Tests: exact-boundary accept/reject + configuration validation. 323x2 suite green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sym7RJ7ehNhbMXytE5rMmS
systemslibrarian
deleted the
features/packed-consumers-and-plaintext-limit
branch
September 5, 2026 12:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two remaining top-tier backlog items, both freeze-safe:
Packed-consumer verification — test the product as consumers receive it
scripts/verify-packed-consumers.sh(locally runnable) + a CI lane: all nine packages → hermetic local feed (prerelease-suffixed + isolatedNUGET_PACKAGES, so a cached published version can never silently shadow the fresh pack — a trap the script itself caught during development), clean net8.0+net10.0 consumer built from packages only, packed-analyzer proof (asserts PQFE101 fires), full API journey on both TFMs, and the packedpqfetool driven end to end (round trips, recipient flow, fingerprint output, wrong-passphrase → exit 65 with no output file). Verified green locally end to end. OSS-Fuzzbuild.shnow builds + seeds both fuzz targets.PqDecryptionLimits.MaxPlaintextBytesTotal-plaintext ceiling enforced before any KDF/decryption work for known-length inputs — the exact plaintext total derives from the container length (safe upper bound even for lenient short-frame containers) and over-limit containers reject as
PqFormatException. Closes the buffered-upload size-amplification hole (external review Medium 2). Default unlimited → zero acceptance change; one shared gate serves the core and Hybrid decryptors; exact-boundary tests added.Verification
323×2 tests green · build clean · docs guard green · packed-consumer script PASS on this machine (both TFMs + tool journey).
🤖 Generated with Claude Code
https://claude.ai/code/session_01Sym7RJ7ehNhbMXytE5rMmS