test(state_transition): harden PKIX load bounds and document trust boundary - #549
Draft
5t4rg4z3r wants to merge 2 commits into
Draft
test(state_transition): harden PKIX load bounds and document trust boundary#5495t4rg4z3r wants to merge 2 commits into
5t4rg4z3r wants to merge 2 commits into
Conversation
…undary Document the PKIX trust boundary as application-owned local cache only and add test coverage for crafted headers and corrupt payload fixtures. Refs ChainSafe#539
Member
|
just testing stargazer out |
spiral-ladder
requested changes
Aug 9, 2026
Comment on lines
+25
to
+29
| * The file is application-owned local cache data, in the same trust class as the application's | ||
| * database files. The caller must keep it under a private cache directory and must scope the path | ||
| * to one network. PKIX stores no network identifier. The loader checks framing, ABI | ||
| * compatibility, bounds, and a checksum to detect corruption or an incompatible build. | ||
| * It does not authenticate the file. Do not pass an operator-supplied or network-sourced path. |
Member
There was a problem hiding this comment.
This is very verbose and a repeat of what's in pkix.zig, can u just refer readers to that file's top level doc comment for trust assumptions
Contributor
Author
There was a problem hiding this comment.
Done in 3a2fec1. The .d.ts block is now two lines that point to the top-level doc comment in src/state_transition/cache/pkix.zig. The full trust assumptions stay in one place.
Verification: zig fmt --check src bindings test bench examples scripts build.zig, pnpm lint (10 pre-existing warnings, none in pubkeys.d.ts), zig build test:state_transition (123/123 pass).
This reply was written by an AI agent (stargazer), supervised by a human.
Replace the duplicated trust boundary text in pubkeys.d.ts with a pointer to the top-level doc comment in src/state_transition/cache/pkix.zig. Refs ChainSafe#539
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
pkix.loadandpkix.savehandle an application-owned local cache snapshot, but nothing in the code said so. A reader could reasonably mistake the loader's framing, ABI, bounds, and checksum checks for input validation and pass the file an operator-supplied path. The existing bounds tests asserted only the returned error, so they could not distinguish a header rejected before allocation from one rejected because an allocation failed, which is the property that actually matters for a crafted header.Closes #539.
Description
loadfunction, and thebindings/src/pubkeys.d.tsdeclarations.expectLoadRejectedWithoutAllocation, which asserts a rejection happened with zero allocation attempts rather than because of a failed one.1 << 30capacity still honors the caller limit.No behavior change. The loader's existing capacity and file-size bounds are unchanged.
Verification
zig build test:state_transition test:ssz test:bls(376 passed)zig fmt --check src bindings test bench examples scripts build.zigpnpm lintpnpm exec vitest run bindings/test/pubkeys.test.ts(19 passed)Spec and ERA suites were not run locally; their download steps are absent in my environment and this change touches no consensus, SSZ, or ERA behavior.
This PR was written by an AI agent (stargazer), supervised by a human.