[PR #1082] [MERGED] fix(artifacts): keep cpio checksum evidence and bound xar TOC elements #2630

New issue

Closed

opened 2026-10-17 21:08:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1082
Author: @morluto
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @morluto

Base: feat/pkg-inventory ← Head: cursor/pkg-inventory-cleanup-d298

📝 Commits (1)

1370c09 fix(artifacts): keep cpio checksum evidence and bound xar TOC elements

📊 Changes

5 files changed (+178 additions, -82 deletions)

View changed files

📝 src/artifacts/CpioArtifactReader.ts (+127 -78)
📝 src/artifacts/InstallerPackageLimits.test.ts (+22 -3)
📝 src/artifacts/XarArtifactReader.ts (+2 -0)
📝 src/artifacts/XarValidation.ts (+24 -0)
📝 tests/boundary/filesystem/installerPackageRecovery.test.ts (+3 -1)

📄 Description

Summary

Review threads on #936 kept finding the same two shapes of failure: integrity checks that throw away the checksum they just computed, and resource limits that run only after a large structure already exists.

CPIO record-and-continue used to catch ArtifactReaderFailure and keep only error.message. Directory, symlink, special-node, and zero-size hard-link CRC failures therefore omitted the declared and observed byte sums that regular-file recovery already reports. One #crcMismatch path now returns that observation for every member kind, and the limitation uses the same sentence as streamed files.
A xar TOC inside the 64 MiB byte cap can still hold millions of elements. parseFromString built that DOM before member collection could charge the metadata budget. Element count is rejected before the DOM is constructed.

The nested-component finding on ArtifactTraversal is not changed. Product archives already list Component.pkg/... as directory members in the outer TOC, and the macOS installer lane on #936 is green.

Verification

npm run test:focused -- src/artifacts/InstallerPackageLimits.test.ts src/artifacts/InstallerPackageReaders.test.ts tests/boundary/filesystem/installerPackageRecovery.test.ts tests/boundary/filesystem/installerPackageInventory.test.ts
Pre-push npm run check:fast

Real Hopper/Ghidra verification was not applicable. The macOS verify:installer-package lane was not re-run here.

Contract

No schema change. Recovered non-file CRC limitations now include declared and observed cpio-byte-sum values. An oversized TOC fails with limit instead of attempting to build the document.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1082 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `feat/pkg-inventory` ← **Head:** `cursor/pkg-inventory-cleanup-d298` --- ### 📝 Commits (1) - [`1370c09`](https://github.com/morluto/rea/commit/1370c09c3c99aac0c04ccc3ec0e502c8b69973eb) fix(artifacts): keep cpio checksum evidence and bound xar TOC elements ### 📊 Changes **5 files changed** (+178 additions, -82 deletions) <details> <summary>View changed files</summary> 📝 `src/artifacts/CpioArtifactReader.ts` (+127 -78) 📝 `src/artifacts/InstallerPackageLimits.test.ts` (+22 -3) 📝 `src/artifacts/XarArtifactReader.ts` (+2 -0) 📝 `src/artifacts/XarValidation.ts` (+24 -0) 📝 `tests/boundary/filesystem/installerPackageRecovery.test.ts` (+3 -1) </details> ### 📄 Description  ## Summary Review threads on #936 kept finding the same two shapes of failure: integrity checks that throw away the checksum they just computed, and resource limits that run only after a large structure already exists. - CPIO record-and-continue used to catch `ArtifactReaderFailure` and keep only `error.message`. Directory, symlink, special-node, and zero-size hard-link CRC failures therefore omitted the declared and observed byte sums that regular-file recovery already reports. One `#crcMismatch` path now returns that observation for every member kind, and the limitation uses the same sentence as streamed files. - A xar TOC inside the 64 MiB byte cap can still hold millions of elements. `parseFromString` built that DOM before member collection could charge the metadata budget. Element count is rejected before the DOM is constructed. The nested-component finding on `ArtifactTraversal` is not changed. Product archives already list `Component.pkg/...` as directory members in the outer TOC, and the macOS installer lane on #936 is green. ## Verification - `npm run test:focused -- src/artifacts/InstallerPackageLimits.test.ts src/artifacts/InstallerPackageReaders.test.ts tests/boundary/filesystem/installerPackageRecovery.test.ts tests/boundary/filesystem/installerPackageInventory.test.ts` - Pre-push `npm run check:fast` Real Hopper/Ghidra verification was not applicable. The macOS `verify:installer-package` lane was not re-run here. ## Contract No schema change. Recovered non-file CRC limitations now include declared and observed `cpio-byte-sum` values. An oversized TOC fails with `limit` instead of attempting to build the document.  <div><a href="https://cursor.com/agents/bc-b50166c8-2750-4725-adf5-16ed0e97d298?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-b50166c8-2750-4725-adf5-16ed0e97d298&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:25 +00:00