morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5687] [Bug] inspect-artifact rejects mountable raw UDRW DMGs as unsupported binaries #3437

New issue

Closed

opened 2026-10-31 00:40:28 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:40:28 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5687

Originally assigned to: @kaoru0822-kitauji on GitHub.

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

inspect-artifact rejects a generated HFS+ UDRW DMG as an unsupported binary and returns no inventory, even after the image is detached. Apple's hdiutil imageinfo identifies it as CRawDiskImage, UDRW, raw read/write; manual read-only attachment succeeds and exposes the expected text file. Converting the same image to UDZO makes REA inspection succeed.

The raw image has no stored checksum: hdiutil verify exits 1 with has no checksum. Mountability does not establish successful checksum verification.

Reproduction

An independent verifier ran the following from the built source checkout on macOS with locked dependencies installed. REA uses isolated profile directories. The raw inspection reproduced both before and after manual detachment; replaying this complete sequence reproduced the detached failure and successful converted control again.

work_dir="$(mktemp -d)"
mkdir -p "$work_dir"/{src,mnt,home,cfg,data,cache,state,tmp}
printf 'raw verifier fixture\n' > "$work_dir/src/hello.txt"
hdiutil create -volname RawVerifierFixture -srcfolder "$work_dir/src" \
  -format UDRW -fs HFS+ "$work_dir/fixture.dmg"
hdiutil imageinfo "$work_dir/fixture.dmg" | grep -E 'Class Name|Format'
# This reports that there is no checksum and exits 1, rather than verifying one.
hdiutil verify "$work_dir/fixture.dmg"
hdiutil attach -readonly -nobrowse -plist -mountroot "$work_dir/mnt" \
  "$work_dir/fixture.dmg" > "$work_dir/attach.plist"
python3 - "$work_dir/attach.plist" <<'PYMOUNT'
import pathlib, plistlib, sys
p = plistlib.loads(pathlib.Path(sys.argv[1]).read_bytes())
for e in p['system-entities']:
    if 'mount-point' in e:
        print((pathlib.Path(e['mount-point']) / 'hello.txt').read_text())
PYMOUNT
device="$(python3 - "$work_dir/attach.plist" <<'PYDEVICE'
import pathlib, plistlib, sys
p = plistlib.loads(pathlib.Path(sys.argv[1]).read_bytes())
print(next(e['dev-entry'] for e in p['system-entities']
           if e.get('content-hint') == 'GUID_partition_scheme'))
PYDEVICE
)"
hdiutil detach "$device"
inspect_image() {
  env -i PATH="$PATH" HOME="$work_dir/home" \
    XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \
    XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \
    TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \
    node scripts/rea.mjs inspect-artifact "$1" --json
}
inspect_image "$work_dir/fixture.dmg"
printf 'raw inspection exit=%s\n' "$?"
# Control and demonstrated workaround:
hdiutil convert "$work_dir/fixture.dmg" -format UDZO -o "$work_dir/control.dmg"
hdiutil verify "$work_dir/control.dmg"
inspect_image "$work_dir/control.dmg" > "$work_dir/control-result.json"
printf 'converted inspection exit=%s\n' "$?"
hdiutil info -plist > "$work_dir/info-after.plist"

Expected behavior

Inventory the native-mountable raw DMG read-only on supported macOS hosts, with checksum availability represented truthfully. Do not claim a missing checksum was verified. A recognized disk image should not receive a generic unsupported-binary refusal with advice to select a well-formed target.

Source-derived contract at the tested revision: src/contracts/artifactToolContracts.ts:83 advertises automatic read-only DMG mounting on supported macOS hosts; src/artifacts/ArtifactProviderMetadata.ts:30 advertises native DMG child inventory. The verifier found no explicit raw UDRW exclusion in the repository documentation.

Impact and scope

P2: the tested mountable disk-image variant receives no inventory and inaccurate generic format guidance. Converting this fixture to UDZO is a demonstrated workaround: REA inventories the same text file and releases its mount, at the cost of an extra conversion and image file. Original image bytes need not be replaced. Raw APFS, Cryptex assets, other image families, and MCP were not tested. No security boundary crossing was identified.

REA version

rea-agents 6.7.0; source baseline 9d8e7803326a382cbbb3ffdb900f5e93e5442d68. Fetched current origin/main at ab58edcdf50b4bd687900ee2dc362ecc5c3dce15: none of the five cited contract/failure-source files changed since the baseline. Main was source-rechecked; runtime observations are from the independently verified baseline, not a fresh main build.

Runtime and platform

Node.js v26.12.0; macOS 27.0.1 arm64; native hdiutil. Hopper/Ghidra are not involved.

Target and artifact context

Self-generated HFS+ raw read/write UDRW DMG containing hello.txt, plus a UDZO conversion of the same image. No third-party target data.

Interface

CLI

Earliest failure stage

Setup or provider admission

Relevant output or evidence

The detached raw inspection exits 1 before the DMG reader is selected:

{
  "code": "target_unavailable",
  "category": "unsupported_target",
  "message": "Cannot open artifact: unsupported binary format.",
  "retryable": false,
  "remediation": {
    "action": "Review the reported file-format reason and select a supported, well-formed target."
  },
  "details": {
    "reason": "unsupported binary format",
    "constraint": "file_format_rejected"
  }
}

Native read-only attachment exposes hello.txt containing raw verifier fixture. The raw image has bytes 45464920 at size minus 512, rather than koly. The converted image passes native checksum verification and REA inspection (exit 0), with root format dmg and occurrence control.dmg/RawVerifierFixture/hello.txt. The verifier checked hdiutil info -plist and confirmed neither fixture remained attached after inspection. Evidence provenance: observed; local verification: independently reproduced.

Typed outcome or recovery expected

Return a DMG root and the contained file with truthful integrity observations and owned-mount cleanup. Preserve the distinction between an absent checksum, a verified checksum, and a checksum mismatch. A generic unsupported-binary error does not identify this native disk-image variant.

Analysis or suspected cause

Source-derived reasoning: src/application/BinaryTargetResolver.ts:348-357 and src/artifacts/inventory/classify.ts:169-173,240-260 require the UDIF koly trailer for DMG classification. This raw image lacks that trailer and is rejected before native verification or attachment.

A classification-only remedy would be insufficient: src/artifacts/NativeDmgArtifactReader.ts:407,489-537,689-710 also requires successful native checksum verification before attachment. This fixture's no-checksum exit status would fail that precondition. That downstream behavior is source-derived; no modified runtime was tested. No bundled dependency was identified as the cause.

Additional context

Prepared with AI assistance and independently verified. This is distinct from #5546 / #5572 (already-mounted image; this fails after detachment), #5547 / #5555 (unsupported extraction guidance), and #5549 / #5592 (checksum-invalid image and ineffective recovery advice). #3290 concerns localized verification diagnostics; this fails before verification. Closed #5188 concerns short positional reads of a synthetic koly signature, while #1491 concerns rejecting suffix-only false format claims; neither covers a native-mountable raw image without that signature.

Proposed restoration checks, not implemented results: rerun the detached raw fixture and successful UDZO control, verify contained-file inventory and mount release, retain malformed-image and checksum-mismatch rejection, and do not classify from a filename alone or claim an absent checksum was verified. NOT_ENOUGH_INFO: no earlier known-good REA version is established.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5687 Originally assigned to: @kaoru0822-kitauji on GitHub. ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `inspect-artifact` rejects a generated HFS+ UDRW DMG as an unsupported binary and returns no inventory, even after the image is detached. Apple's `hdiutil imageinfo` identifies it as `CRawDiskImage`, `UDRW`, `raw read/write`; manual read-only attachment succeeds and exposes the expected text file. Converting the same image to UDZO makes REA inspection succeed. The raw image has no stored checksum: `hdiutil verify` exits 1 with `has no checksum`. Mountability does not establish successful checksum verification. ### Reproduction An independent verifier ran the following from the built source checkout on macOS with locked dependencies installed. REA uses isolated profile directories. The raw inspection reproduced both before and after manual detachment; replaying this complete sequence reproduced the detached failure and successful converted control again. ```sh work_dir="$(mktemp -d)" mkdir -p "$work_dir"/{src,mnt,home,cfg,data,cache,state,tmp} printf 'raw verifier fixture\n' > "$work_dir/src/hello.txt" hdiutil create -volname RawVerifierFixture -srcfolder "$work_dir/src" \ -format UDRW -fs HFS+ "$work_dir/fixture.dmg" hdiutil imageinfo "$work_dir/fixture.dmg" | grep -E 'Class Name|Format' # This reports that there is no checksum and exits 1, rather than verifying one. hdiutil verify "$work_dir/fixture.dmg" hdiutil attach -readonly -nobrowse -plist -mountroot "$work_dir/mnt" \ "$work_dir/fixture.dmg" > "$work_dir/attach.plist" python3 - "$work_dir/attach.plist" <<'PYMOUNT' import pathlib, plistlib, sys p = plistlib.loads(pathlib.Path(sys.argv[1]).read_bytes()) for e in p['system-entities']: if 'mount-point' in e: print((pathlib.Path(e['mount-point']) / 'hello.txt').read_text()) PYMOUNT device="$(python3 - "$work_dir/attach.plist" <<'PYDEVICE' import pathlib, plistlib, sys p = plistlib.loads(pathlib.Path(sys.argv[1]).read_bytes()) print(next(e['dev-entry'] for e in p['system-entities'] if e.get('content-hint') == 'GUID_partition_scheme')) PYDEVICE )" hdiutil detach "$device" inspect_image() { env -i PATH="$PATH" HOME="$work_dir/home" \ XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \ XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \ TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \ node scripts/rea.mjs inspect-artifact "$1" --json } inspect_image "$work_dir/fixture.dmg" printf 'raw inspection exit=%s\n' "$?" # Control and demonstrated workaround: hdiutil convert "$work_dir/fixture.dmg" -format UDZO -o "$work_dir/control.dmg" hdiutil verify "$work_dir/control.dmg" inspect_image "$work_dir/control.dmg" > "$work_dir/control-result.json" printf 'converted inspection exit=%s\n' "$?" hdiutil info -plist > "$work_dir/info-after.plist" ``` ### Expected behavior Inventory the native-mountable raw DMG read-only on supported macOS hosts, with checksum availability represented truthfully. Do not claim a missing checksum was verified. A recognized disk image should not receive a generic unsupported-binary refusal with advice to select a well-formed target. Source-derived contract at the tested revision: `src/contracts/artifactToolContracts.ts:83` advertises automatic read-only DMG mounting on supported macOS hosts; `src/artifacts/ArtifactProviderMetadata.ts:30` advertises native DMG child inventory. The verifier found no explicit raw UDRW exclusion in the repository documentation. ### Impact and scope P2: the tested mountable disk-image variant receives no inventory and inaccurate generic format guidance. Converting this fixture to UDZO is a demonstrated workaround: REA inventories the same text file and releases its mount, at the cost of an extra conversion and image file. Original image bytes need not be replaced. Raw APFS, Cryptex assets, other image families, and MCP were not tested. No security boundary crossing was identified. ### REA version `rea-agents` 6.7.0; source baseline `9d8e7803326a382cbbb3ffdb900f5e93e5442d68`. Fetched current `origin/main` at `ab58edcdf50b4bd687900ee2dc362ecc5c3dce15`: none of the five cited contract/failure-source files changed since the baseline. Main was source-rechecked; runtime observations are from the independently verified baseline, not a fresh main build. ### Runtime and platform Node.js v26.12.0; macOS 27.0.1 arm64; native `hdiutil`. Hopper/Ghidra are not involved. ### Target and artifact context Self-generated HFS+ raw read/write UDRW DMG containing `hello.txt`, plus a UDZO conversion of the same image. No third-party target data. ### Interface CLI ### Earliest failure stage Setup or provider admission ### Relevant output or evidence The detached raw inspection exits 1 before the DMG reader is selected: ```json { "code": "target_unavailable", "category": "unsupported_target", "message": "Cannot open artifact: unsupported binary format.", "retryable": false, "remediation": { "action": "Review the reported file-format reason and select a supported, well-formed target." }, "details": { "reason": "unsupported binary format", "constraint": "file_format_rejected" } } ``` Native read-only attachment exposes `hello.txt` containing `raw verifier fixture`. The raw image has bytes `45464920` at size minus 512, rather than `koly`. The converted image passes native checksum verification and REA inspection (exit 0), with root format `dmg` and occurrence `control.dmg/RawVerifierFixture/hello.txt`. The verifier checked `hdiutil info -plist` and confirmed neither fixture remained attached after inspection. Evidence provenance: observed; local verification: independently reproduced. ### Typed outcome or recovery expected Return a DMG root and the contained file with truthful integrity observations and owned-mount cleanup. Preserve the distinction between an absent checksum, a verified checksum, and a checksum mismatch. A generic unsupported-binary error does not identify this native disk-image variant. ### Analysis or suspected cause Source-derived reasoning: `src/application/BinaryTargetResolver.ts:348-357` and `src/artifacts/inventory/classify.ts:169-173,240-260` require the UDIF `koly` trailer for DMG classification. This raw image lacks that trailer and is rejected before native verification or attachment. A classification-only remedy would be insufficient: `src/artifacts/NativeDmgArtifactReader.ts:407,489-537,689-710` also requires successful native checksum verification before attachment. This fixture's no-checksum exit status would fail that precondition. That downstream behavior is source-derived; no modified runtime was tested. No bundled dependency was identified as the cause. ### Additional context Prepared with AI assistance and independently verified. This is distinct from #5546 / #5572 (already-mounted image; this fails after detachment), #5547 / #5555 (unsupported extraction guidance), and #5549 / #5592 (checksum-invalid image and ineffective recovery advice). #3290 concerns localized verification diagnostics; this fails before verification. Closed #5188 concerns short positional reads of a synthetic `koly` signature, while #1491 concerns rejecting suffix-only false format claims; neither covers a native-mountable raw image without that signature. Proposed restoration checks, not implemented results: rerun the detached raw fixture and successful UDZO control, verify contained-file inventory and mount release, retain malformed-image and checksum-mismatch rejection, and do not classify from a filename alone or claim an absent checksum was verified. NOT_ENOUGH_INFO: no earlier known-good REA version is established.

bsakaguchi closed this issue

2026-10-31 00:40:28 +00:00

bsakaguchi commented

2026-10-31 00:40:29 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with canonical issue #5546 ([Bug] inspect-artifact discards root observations when a DMG is already mounted) and sibling Apple DMG artifact reports #5547, #5549.

Consolidated under Cluster BB (Apple DMG Artifact Inspection, Mount Handling & Integrity Policy) in tracker #4330.

@matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with canonical issue #5546 (`[Bug] inspect-artifact discards root observations when a DMG is already mounted`) and sibling Apple DMG artifact reports #5547, #5549. Consolidated under **Cluster BB (Apple DMG Artifact Inspection, Mount Handling & Integrity Policy)** in tracker #4330.

bsakaguchi commented

2026-10-31 00:40:29 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Source review at d87e73f still finds two separate barriers for the reported raw UDRW image. Target admission and root inventory classification both require the koly trailer. The issue reports a native-mountable CRawDiskImage without that trailer, so neither boundary recognizes that variant as DMG. The related already-mounted-image work does not establish restoration of this detached-input case.

Recognition alone would not complete the fix: the reader verifies before attachment, and its verification routine propagates nonzero failures. The reported raw fixture returns has no checksum, not successful verification. That requires an explicit checksum-absent policy rather than treating every verification failure as success. The existing native checksum regression converts its writable image to UDRO before testing corruption; it does not demonstrate checksum-free raw inventory.

These are source-derived findings. Mountability, the absent checksum and successful UDZO workaround are evidence reported in the issue; I did not rerun native tools.

Closure should show the detached original UDRW producing its contained-file inventory, truthful unavailable-checksum observations and owned-mount cleanup, alongside the successful UDZO control and retained malformed-image/checksum-mismatch refusals. If checksum-free raw images are intentionally unsupported, the supported-format contract and variant-specific refusal need an explicit decision. A generic unsupported-binary result still does not explain that boundary.

@coygeek commented on GitHub (Oct 24, 2026): Source review at `d87e73f` still finds two separate barriers for the reported raw UDRW image. [Target admission](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/BinaryTargetResolver.ts#L619-L629) and [root inventory classification](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/artifacts/inventory/classify.ts#L186-L190) both require the `koly` trailer. The issue reports a native-mountable `CRawDiskImage` without that trailer, so neither boundary recognizes that variant as DMG. The related already-mounted-image work does not establish restoration of this detached-input case. Recognition alone would not complete the fix: the reader verifies before attachment, and [its verification routine propagates nonzero failures](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/artifacts/NativeDmgArtifactReader.ts#L487-L529). The reported raw fixture returns `has no checksum`, not successful verification. That requires an explicit checksum-absent policy rather than treating every verification failure as success. The [existing native checksum regression](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/providers/native/nativeDmgArtifactReader.test.ts#L1642-L1659) converts its writable image to UDRO before testing corruption; it does not demonstrate checksum-free raw inventory. These are source-derived findings. Mountability, the absent checksum and successful UDZO workaround are evidence reported in the issue; I did not rerun native tools. Closure should show the detached original UDRW producing its contained-file inventory, truthful unavailable-checksum observations and owned-mount cleanup, alongside the successful UDZO control and retained malformed-image/checksum-mismatch refusals. If checksum-free raw images are intentionally unsupported, the supported-format contract and variant-specific refusal need an explicit decision. A generic unsupported-binary result still does not explain that boundary.

bsakaguchi referenced this issue

2026-10-31 01:09:06 +00:00

[PR #3440] [CLOSED] fix(security): pin CI actions, protect Hopper xauth and downloads, flag old apktool #5743

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3437

No description provided.

Rows
Columns