18 lines
1.8 KiB
Markdown
18 lines
1.8 KiB
Markdown
# 测试数据
|
|
|
|
本目录只保存公开、虚构、不可用于生产的数据与攻击样例。
|
|
|
|
- 不放生产私钥、真实注册码、真实机器标识或真实下载地址。
|
|
- 测试若需要签名,使用测试代码中明确标注的专用测试密钥。
|
|
- 恶意样例用于证明解析器和安全边界会拒绝输入,不得被发布流程消费。
|
|
- `catalog/manifest-valid-payload.json` 同时作为 manifest v1 强类型解析与目标过滤的公开虚构样例;包哈希与签名只保证格式合法,不对应真实下载物。
|
|
- `download/`:T-301 在运行时生成 HTTPS Range、断连、并发和恢复样例,不保存真实下载包。
|
|
|
|
## Catalog canonicalization vectors
|
|
|
|
`catalog/canonical-vectors.json` is the versioned, cross-implementation signing corpus for the Catalog signature domain. It contains only a public RFC 8032 test key and fixed synthetic documents, canonical signing bytes and Ed25519 signatures; it never contains a production private key, real Catalog URL or release signature.
|
|
|
|
Each `document` is the raw UTF-8 JSON text passed to the verifier. A successful vector provides the exact `signed_payload_base64` and top-level `signature`; a rejecting vector provides `want_error` (`invalid_document`, `unsupported_number` or `signature_invalid`). Both the client and the external `softbox-catalog` publisher must consume these static values verbatim. They must not recreate expected bytes or signatures by calling their own canonicalizer or signing helper.
|
|
|
|
The corpus freezes Unicode key sorting/escaping, U+2028/U+2029, valid and invalid surrogate behavior, `-0` and large integers, nested `signature`, canonical padded Base64 and semantic-equivalent JSON representations. Extending it is a protocol change: increment `schema_version` when its interpretation changes and update `docs/api.md` together with client and publisher tests.
|