[GH-ISSUE #6622] [Bug] Rust inspection rejects historical cargo-auditable features metadata #4008

New issue

Closed

opened 2026-10-31 00:46:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:46:00 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6622

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The public inspect-rust-binary CLI rejects a .dep-v0 document containing the features package field serialized by cargo-auditable 0.4.0. It exits 1 with invalid_request, invalid_format, and Dependency package 0 does not match the package schema; neither package identities nor dependency edges are returned. A matched document without that field succeeds and returns both packages and the edge from package 1 to package 0.

This is an executed CLI observation on an authored ELF containing the released historical JSON shape. It is not a run of cargo-auditable 0.4.0 or a compiler-produced historical executable.

Reproduction

Use the source revision below with locked dependencies and its built CLI. The executed Node/tsx probe used the existing createRustImage and rustDependencyPayload helpers from tests/fixtures/rust/image.ts:

Zlib-compress this document and pass it as payload to createRustImage({format: "elf", includeRustc: false, payload}). Save the returned bytes as legacy-features.elf.

{"packages":[{"name":"example_dep","version":"1.2.3","source":"crates.io","features":["default"]},{"name":"example_app","version":"0.1.0","source":"local","dependencies":[0]}]}

Run node scripts/rea.mjs inspect-rust-binary /artifacts/legacy-features.elf --json with the saved file's actual absolute path. The CLI exits 1 with the error above.
For the matched control, omit only features, regenerate the compressed payload and authored ELF, and run the same CLI command. The CLI exits 0 and returns both packages and dependency_edges: [{"from_index":1,"to_index":0}].

Each CLI case ran once before drafting. Both files contain a file-backed, uncompressed ELF SHT_PROGBITS section named .dep-v0 at offset 1024. The rejected section is 121 bytes and the control section is 110 bytes; both whole files are 4096 bytes. Independent Node zlib inflation and JSON parsing recover each complete document from its file. GNU readelf --file-header --sections recognizes the rejected file and its section. No target code executes.

Expected behavior

Recognize the known historical field without discarding the package identities and dependency edges, or identify a deliberate historical-format exclusion as unsupported instead of calling the valid released representation malformed.

The primary format evidence is cargo-auditable's released 0.4.0 Package serializer, which serializes nonempty features arrays. Its conversion from Cargo metadata fills that array. The 0.5.0 changelog records its removal. Version 0.4.0 already used the .dep-v0 section and __DATA placement introduced by preceding releases; the same changelog records those transitions.

REA's Rust guide advertises cargo-auditable package and dependency inspection and permits an omitted format revision. The guide currently documents unknown-field rejection; this report identifies a specific known field from the released historical format that falls under that rejection. It does not establish a failure for current cargo-auditable output.

Impact and scope

Existing binaries carrying this pre-0.5 metadata shape cannot yield dependency Evidence through the shared Rust reader. The observed case loses a two-package graph because one package retains enabled-feature metadata. The input remains unchanged. Only an authored ELF was exercised through the CLI; PE, Mach-O, MCP, real historical compiler artifacts, and the published REA package runtime were not exercised. Source establishes the released serializer field and REA's rejecting guard, not the prevalence of affected binaries.

Direct extraction and zlib/JSON decoding of the same .dep-v0 bytes recovers the package facts; that workaround was demonstrated on the rejected fixture. It does not produce REA's normalized Evidence.

REA version

Executed: current-main checkout aee249b1ddb3e643b22ce049909160f0ce37a63e, whose built CLI reports 6.7.0.

Release-source comparison only: published 6.7.0 tag commit 27dc42d10249f0410904a75c0997842eb03b931c has the same package-field whitelist and unknown-field rejection. Its packaged runtime was not run for this report.

Runtime and platform

Node v24.22.1; Linux x86_64; GNU readelf 2.47. No Rust compiler, disassembler, or provider process was used.

Target and artifact context

Authored ELF64 little-endian x86-64 with a .dep-v0 zlib JSON section shaped from the cargo-auditable 0.4.0 serializer. Rejected fixture SHA-256: 47fe2b3c2964fd9097ea13bd5d872946dbe7cf80b87287db603bd8d6cc75a7a9. Control SHA-256: 3935473661b999f17c2b0fbd1b517b73d20cb25050cf15380f5610c9a8a1e6f0.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Rejected CLI excerpt, with the selected path omitted:

{"code":"invalid_request","category":"invalid_input","retryable":false,"details":{"operation":"inspect_rust_binary","issues":[{"path":["path"],"reason":"invalid_format","message":"Dependency package 0 does not match the package schema"}]}}

Source-derived cause: packageSchema and PACKAGE_FIELDS / packageRecord exclude features. The latter rejects the package before graph normalization. The released 6.7.0 source contains the same whitelist and rejection.

Evidence provenance: observed CLI and direct decompression; released serializer behavior and released REA guard are source-derived. Local verification: reproduced with an authored fixture. Reproduction completeness: complete for that fixture; actual historical producer artifact coverage is unavailable.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A known released historical metadata field causes the demonstrated Rust inspection path to discard all package and graph results for a bounded input class. The matched control succeeds; current producer output is not shown to fail.
Workaround status: available
Workaround basis: Direct extraction followed by zlib inflation and JSON parsing recovers the complete package document from the same rejected fixture without modifying it; this was executed, although it does not create REA Evidence.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6622 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior The public `inspect-rust-binary` CLI rejects a `.dep-v0` document containing the `features` package field serialized by cargo-auditable 0.4.0. It exits 1 with `invalid_request`, `invalid_format`, and `Dependency package 0 does not match the package schema`; neither package identities nor dependency edges are returned. A matched document without that field succeeds and returns both packages and the edge from package 1 to package 0. This is an executed CLI observation on an authored ELF containing the released historical JSON shape. It is not a run of cargo-auditable 0.4.0 or a compiler-produced historical executable. ## Reproduction Use the source revision below with locked dependencies and its built CLI. The executed Node/tsx probe used the existing `createRustImage` and `rustDependencyPayload` helpers from `tests/fixtures/rust/image.ts`: 1. Zlib-compress this document and pass it as `payload` to `createRustImage({format: "elf", includeRustc: false, payload})`. Save the returned bytes as `legacy-features.elf`. ```json {"packages":[{"name":"example_dep","version":"1.2.3","source":"crates.io","features":["default"]},{"name":"example_app","version":"0.1.0","source":"local","dependencies":[0]}]} ``` 2. Run `node scripts/rea.mjs inspect-rust-binary /artifacts/legacy-features.elf --json` with the saved file's actual absolute path. The CLI exits 1 with the error above. 3. For the matched control, omit only `features`, regenerate the compressed payload and authored ELF, and run the same CLI command. The CLI exits 0 and returns both packages and `dependency_edges: [{"from_index":1,"to_index":0}]`. Each CLI case ran once before drafting. Both files contain a file-backed, uncompressed ELF `SHT_PROGBITS` section named `.dep-v0` at offset 1024. The rejected section is 121 bytes and the control section is 110 bytes; both whole files are 4096 bytes. Independent Node zlib inflation and JSON parsing recover each complete document from its file. GNU `readelf --file-header --sections` recognizes the rejected file and its section. No target code executes. ## Expected behavior Recognize the known historical field without discarding the package identities and dependency edges, or identify a deliberate historical-format exclusion as unsupported instead of calling the valid released representation malformed. The primary format evidence is cargo-auditable's [released 0.4.0 `Package` serializer](https://github.com/rust-secure-code/cargo-auditable/blob/v0.4.0/auditable-serde/src/lib.rs#L114-L120), which serializes nonempty `features` arrays. Its [conversion from Cargo metadata](https://github.com/rust-secure-code/cargo-auditable/blob/v0.4.0/auditable-serde/src/lib.rs#L413-L416) fills that array. The [0.5.0 changelog](https://github.com/rust-secure-code/cargo-auditable/blob/v0.5.0/CHANGELOG.md#L15-L16) records its removal. Version 0.4.0 already used the `.dep-v0` section and `__DATA` placement introduced by preceding releases; the same changelog records those transitions. REA's [Rust guide](https://github.com/morluto/rea/blob/aee249b1ddb3e643b22ce049909160f0ce37a63e/docs/rust-binaries.md) advertises cargo-auditable package and dependency inspection and permits an omitted format revision. The guide currently documents unknown-field rejection; this report identifies a specific known field from the released historical format that falls under that rejection. It does not establish a failure for current cargo-auditable output. ## Impact and scope Existing binaries carrying this pre-0.5 metadata shape cannot yield dependency Evidence through the shared Rust reader. The observed case loses a two-package graph because one package retains enabled-feature metadata. The input remains unchanged. Only an authored ELF was exercised through the CLI; PE, Mach-O, MCP, real historical compiler artifacts, and the published REA package runtime were not exercised. Source establishes the released serializer field and REA's rejecting guard, not the prevalence of affected binaries. Direct extraction and zlib/JSON decoding of the same `.dep-v0` bytes recovers the package facts; that workaround was demonstrated on the rejected fixture. It does not produce REA's normalized Evidence. ## REA version Executed: current-main checkout `aee249b1ddb3e643b22ce049909160f0ce37a63e`, whose built CLI reports `6.7.0`. Release-source comparison only: published 6.7.0 tag commit `27dc42d10249f0410904a75c0997842eb03b931c` has the same package-field whitelist and unknown-field rejection. Its packaged runtime was not run for this report. ## Runtime and platform Node v24.22.1; Linux x86_64; GNU readelf 2.47. No Rust compiler, disassembler, or provider process was used. ## Target and artifact context Authored ELF64 little-endian x86-64 with a `.dep-v0` zlib JSON section shaped from the cargo-auditable 0.4.0 serializer. Rejected fixture SHA-256: `47fe2b3c2964fd9097ea13bd5d872946dbe7cf80b87287db603bd8d6cc75a7a9`. Control SHA-256: `3935473661b999f17c2b0fbd1b517b73d20cb25050cf15380f5610c9a8a1e6f0`. ## Interface CLI ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence Rejected CLI excerpt, with the selected path omitted: ```json {"code":"invalid_request","category":"invalid_input","retryable":false,"details":{"operation":"inspect_rust_binary","issues":[{"path":["path"],"reason":"invalid_format","message":"Dependency package 0 does not match the package schema"}]}} ``` Source-derived cause: [`packageSchema`](https://github.com/morluto/rea/blob/aee249b1ddb3e643b22ce049909160f0ce37a63e/src/rust/RustAuditableReader.ts#L21-L28) and [`PACKAGE_FIELDS` / `packageRecord`](https://github.com/morluto/rea/blob/aee249b1ddb3e643b22ce049909160f0ce37a63e/src/rust/RustAuditableReader.ts#L309-L345) exclude `features`. The latter rejects the package before graph normalization. The released 6.7.0 source contains the [same whitelist and rejection](https://github.com/morluto/rea/blob/27dc42d10249f0410904a75c0997842eb03b931c/src/rust/RustAuditableReader.ts). Evidence provenance: observed CLI and direct decompression; released serializer behavior and released REA guard are source-derived. Local verification: reproduced with an authored fixture. Reproduction completeness: complete for that fixture; actual historical producer artifact coverage is unavailable. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A known released historical metadata field causes the demonstrated Rust inspection path to discard all package and graph results for a bounded input class. The matched control succeeds; current producer output is not shown to fail. - Workaround status: available - Workaround basis: Direct extraction followed by zlib inflation and JSON parsing recovers the complete package document from the same rejected fixture without modifying it; this was executed, although it does not create REA Evidence.

bsakaguchi closed this issue

2026-10-31 00:46:00 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:12 +00:00

[PR #4048] [MERGED] fix(native): retain every repeated otool load-command field #6016