Freeze catalog signature vectors (T-614)

2026-07-18 16:46:17 +08:00
parent 9e5f3f4840
commit 0c1b7662c6
11 changed files with 370 additions and 32 deletions
@@ -7,3 +7,11 @@
 - 恶意样例用于证明解析器和安全边界会拒绝输入,不得被发布流程消费。
 - `catalog/manifest-valid-payload.json` 同时作为 manifest v1 强类型解析与目标过滤的公开虚构样例;包哈希与签名只保证格式合法,不对应真实下载物。
 - `download/`:T-301 在运行时生成 HTTPS Range、断连、并发和恢复样例,不保存真实下载包。
+
+## Catalog canonicalization vectors
+
+`catalog/canonical-vectors.json` is the versioned, cross-implementation signing corpus for the Catalog signature domain. It contains only a public RFC 8032 test key and fixed synthetic documents, canonical signing bytes and Ed25519 signatures; it never contains a production private key, real Catalog URL or release signature.
+
+Each `document` is the raw UTF-8 JSON text passed to the verifier. A successful vector provides the exact `signed_payload_base64` and top-level `signature`; a rejecting vector provides `want_error` (`invalid_document`, `unsupported_number` or `signature_invalid`). Both the client and the external `softbox-catalog` publisher must consume these static values verbatim. They must not recreate expected bytes or signatures by calling their own canonicalizer or signing helper.
+
+The corpus freezes Unicode key sorting/escaping, U+2028/U+2029, valid and invalid surrogate behavior, `-0` and large integers, nested `signature`, canonical padded Base64 and semantic-equivalent JSON representations. Extending it is a protocol change: increment `schema_version` when its interpretation changes and update `docs/api.md` together with client and publisher tests.
@@ -0,0 +1,69 @@
+{
+  "schema_version": 1,
+  "public_key_base64": "11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=",
+  "vectors": [
+    {
+      "name": "unicode-escapes-sorted-keys-and-nested-signature",
+      "document": "{\"z\":\"\\u003c\\u003e\\u0026\\u2028\\u2029\",\"nested\":{\"signature\":\"inner\",\"n\":9007199254740993},\"emoji\":\"\\uD83D\\uDE00\",\"\\u00e9\":\"\\u00e9\",\"a\":\"line\\u000aquote\\u0022slash\\u005c\",\"signature\":\"JS8or6xTEfGtGOoxPbephpnYbB15fcRL1VnEcoQ0IZIHDx6URuRs3SciDIubEqxVCqy+GVOuyD2lRAOLm11OBQ==\"}",
+      "signed_payload_base64": "eyJhIjoibGluZVxucXVvdGVcInNsYXNoXFwiLCJlbW9qaSI6IvCfmIAiLCJuZXN0ZWQiOnsibiI6OTAwNzE5OTI1NDc0MDk5Mywic2lnbmF0dXJlIjoiaW5uZXIifSwieiI6Ilx1MDAzY1x1MDAzZVx1MDAyNlx1MjAyOFx1MjAyOSIsIsOpIjoiw6kifQ==",
+      "signature": "JS8or6xTEfGtGOoxPbephpnYbB15fcRL1VnEcoQ0IZIHDx6URuRs3SciDIubEqxVCqy+GVOuyD2lRAOLm11OBQ=="
+    },
+    {
+      "name": "equivalent-object-order-a",
+      "document": "{\"b\":[true,null,\"x\"],\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg==\",\"a\":0}",
+      "signed_payload_base64": "eyJhIjowLCJiIjpbdHJ1ZSxudWxsLCJ4Il19",
+      "signature": "ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg=="
+    },
+    {
+      "name": "equivalent-object-order-b",
+      "document": " { \"a\" : 0 , \"b\" : [ true , null , \"x\" ] , \"signature\" : \"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg==\" } ",
+      "signed_payload_base64": "eyJhIjowLCJiIjpbdHJ1ZSxudWxsLCJ4Il19",
+      "signature": "ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg=="
+    },
+    {
+      "name": "reject-isolated-high-surrogate",
+      "document": "{\"value\":\"\\uD800\",\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg==\"}",
+      "want_error": "invalid_document"
+    },
+    {
+      "name": "reject-isolated-low-surrogate",
+      "document": "{\"value\":\"\\uDC00\",\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg==\"}",
+      "want_error": "invalid_document"
+    },
+    {
+      "name": "reject-mismatched-surrogate-pair",
+      "document": "{\"value\":\"\\uD800\\u0041\",\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg==\"}",
+      "want_error": "invalid_document"
+    },
+    {
+      "name": "reject-negative-zero",
+      "document": "{\"n\":-0,\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg==\"}",
+      "want_error": "unsupported_number"
+    },
+    {
+      "name": "reject-signature-crlf",
+      "document": "{\"a\":0,\"b\":[true,null,\"x\"],\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59\\r\\nAdULCg==\"}",
+      "want_error": "signature_invalid"
+    },
+    {
+      "name": "reject-signature-space",
+      "document": "{\"a\":0,\"b\":[true,null,\"x\"],\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg== \"}",
+      "want_error": "signature_invalid"
+    },
+    {
+      "name": "reject-signature-tab",
+      "document": "{\"a\":0,\"b\":[true,null,\"x\"],\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg==\\t\"}",
+      "want_error": "signature_invalid"
+    },
+    {
+      "name": "reject-signature-missing-padding",
+      "document": "{\"a\":0,\"b\":[true,null,\"x\"],\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg\"}",
+      "want_error": "signature_invalid"
+    },
+    {
+      "name": "reject-signature-extra-padding",
+      "document": "{\"a\":0,\"b\":[true,null,\"x\"],\"signature\":\"ozK/qFxWS+WX2Ic//QJMP87iDQqm1jXNv+1BE45/eddfx92zcq20x74Xo8VjO6zAOirKTj5OilL5JL59AdULCg===\"}",
+      "want_error": "signature_invalid"
+    }
+  ]
+}