[PR #2405] [CLOSED] fix(artifacts): classify JVM class files instead of universal Mach-O for CAFEBABE bytes #5205

New issue

Closed

opened 2026-10-31 01:04:47 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:04:47 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2405
Author: @Gideon145
Created: 10/12/2026
Status: ❌ Closed

Base: main ← Head: fix-artifact-jvm-class-misclassification

📝 Commits (1)

f7995ec fix(artifacts): classify JVM class files instead of universal Mach-O for CAFEBABE bytes

📊 Changes

2 files changed (+80 additions, -0 deletions)

View changed files

➕ src/artifacts/inventory/ArtifactGraphConstruction.test.ts (+64 -0)
📝 src/artifacts/inventory/ArtifactGraphConstruction.ts (+16 -0)

📄 Description

## The problem

classifyArtifactBytes labels every entry whose first four bytes are CA FE BA BE as mach-o-universal. JVM class files start with the same four bytes, so inspect-artifact reports a JAR's .class entries as universal Mach-O executables, with no limitation and coverage: complete-within-substeps. file identifies the same bytes as "compiled Java class data, version 65.0".

The change

When the magic is 0xCAFEBABE, read bytes 4-8 as a candidate JVM class header: the minor and major version (big-endian u2 each). If the minor is 0 or 65535 (preview features) and the major is between 45 and 90, classify the bytes as a plain file instead of a universal Mach-O. A FAT Mach-O stores nfat_arch (a small architecture count, typically 1-16) in the same four bytes, so real universal binaries still classify as mach-o-universal. Byte-swapped universal magic (0xbebafeca, 0xcafebabf, 0xbfbafeca) is untouched.

Test

New test file src/artifacts/inventory/ArtifactGraphConstruction.test.ts covers:

a version 65 JVM class prefix classifies as file
a preview-release JVM class prefix classifies as file
a big-endian FAT Mach-O header classifies as mach-o-universal
byte-swapped universal magic classifies as mach-o-universal

Fixes #2317.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2405 **Author:** [@Gideon145](https://github.com/Gideon145) **Created:** 10/12/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix-artifact-jvm-class-misclassification` --- ### 📝 Commits (1) - [`f7995ec`](https://github.com/morluto/rea/commit/f7995ecfad93bfa0121ce3e2ed6aaa942b58c9ea) fix(artifacts): classify JVM class files instead of universal Mach-O for CAFEBABE bytes ### 📊 Changes **2 files changed** (+80 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `src/artifacts/inventory/ArtifactGraphConstruction.test.ts` (+64 -0) 📝 `src/artifacts/inventory/ArtifactGraphConstruction.ts` (+16 -0) </details> ### 📄 Description ## The problem `classifyArtifactBytes` labels every entry whose first four bytes are `CA FE BA BE` as `mach-o-universal`. JVM class files start with the same four bytes, so `inspect-artifact` reports a JAR's `.class` entries as universal Mach-O executables, with no limitation and `coverage: complete-within-substeps`. `file` identifies the same bytes as "compiled Java class data, version 65.0". ## The change When the magic is `0xCAFEBABE`, read bytes 4-8 as a candidate JVM class header: the minor and major version (big-endian u2 each). If the minor is 0 or 65535 (preview features) and the major is between 45 and 90, classify the bytes as a plain file instead of a universal Mach-O. A FAT Mach-O stores `nfat_arch` (a small architecture count, typically 1-16) in the same four bytes, so real universal binaries still classify as `mach-o-universal`. Byte-swapped universal magic (`0xbebafeca`, `0xcafebabf`, `0xbfbafeca`) is untouched. ## Test New test file `src/artifacts/inventory/ArtifactGraphConstruction.test.ts` covers: - a version 65 JVM class prefix classifies as `file` - a preview-release JVM class prefix classifies as `file` - a big-endian FAT Mach-O header classifies as `mach-o-universal` - byte-swapped universal magic classifies as `mach-o-universal` Fixes #2317. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:04:47 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5205

No description provided.

Rows
Columns