测试数据
本目录只保存公开、虚构、不可用于生产的数据与攻击样例。
- 不放生产私钥、真实注册码、真实机器标识或真实下载地址。
- 测试若需要签名,使用测试代码中明确标注的专用测试密钥。
- 恶意样例用于证明解析器和安全边界会拒绝输入,不得被发布流程消费。
catalog/manifest-valid-payload.json同时作为 manifest v1 强类型解析与目标过滤的公开虚构样例;包哈希与签名只保证格式合法,不对应真实下载物。download/:T-301 在运行时生成 HTTPS Range、断连、并发和恢复样例,不保存真实下载包。
Catalog canonicalization vectors
catalog/canonical-vectors.json is the versioned, cross-implementation signing corpus for the Catalog signature domain. It contains only a public RFC 8032 test key and fixed synthetic documents, canonical signing bytes and Ed25519 signatures; it never contains a production private key, real Catalog URL or release signature.
Each document is the raw UTF-8 JSON text passed to the verifier. A successful vector provides the exact signed_payload_base64 and top-level signature; a rejecting vector provides want_error (invalid_document, unsupported_number or signature_invalid). Both the client and the external softbox-catalog publisher must consume these static values verbatim. They must not recreate expected bytes or signatures by calling their own canonicalizer or signing helper.
The corpus freezes Unicode key sorting/escaping, U+2028/U+2029, valid and invalid surrogate behavior, -0 and large integers, nested signature, canonical padded Base64 and semantic-equivalent JSON representations. Extending it is a protocol change: increment schema_version when its interpretation changes and update docs/api.md together with client and publisher tests.