[PR #5211] [CLOSED] Fix #4856: Prevent call stack overflow on large TOML files #6817

New issue

Closed

opened 2026-11-01 21:43:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:43:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5211
Author: @uyg7x
Created: 10/19/2026
Status: ❌ Closed

Base: main ← Head: docs/apk-signature-grammar-final

📝 Commits (10+)

f8ce23e feat(apk): locate and frame the APK Signing Block (v2+ foundation)
40df3ad feat(apk): decode v2/v3/v3.1 signer structures from the signing block
b2b95ab feat(apk): detect v1 (JAR) signing from the central directory
f160be6 feat(apk): public result schema and tamper-surface posture derivation
9cf1b9b feat(apk): provider, service and CLI/MCP/catalog wiring for inspect_apk_signature
da27214 feat(apk): recompute the v2/v3 content digest for self-consistency
23108ca feat(apk): decode the v3 rotation lineage; stop flagging rotation as tampering
f44068e test(apk): add the apksigner/aapt2 real-toolchain lane (verify:apk-signature)
023a838 test(apk): SDK-free provider tests for inspect_apk_signature
addf92a fix(apk): enforce the output budget and keep observed and declared facts apart

📊 Changes

50 files changed (+8089 additions, -48 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+6 -0)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+17 -0)
📝 README.md (+26 -0)
➕ docs/apk-signature.md (+182 -0)
📝 docs/architecture.mermaid (+3 -0)
📝 docs/index.md (+11 -0)
➕ docs/specs/apk-signature/spec.md (+113 -0)
📝 package.json (+1 -0)
📝 scripts/lib/catalog-builders.mjs (+5 -0)
📝 scripts/lib/catalog-core.mjs (+3 -0)
📝 scripts/lib/test-projects.mjs (+1 -1)
➕ scripts/verify-apk-signature.mjs (+689 -0)
➕ src/apkSignature/ApkSignatureProvider.test.ts (+642 -0)
➕ src/apkSignature/ApkSignatureProvider.ts (+571 -0)
➕ src/apkSignature/ApkSignatureRelease.ts (+21 -0)
➕ src/apkSignature/apkCertificateFacts.ts (+65 -0)
➕ src/apkSignature/apkSignatureFailures.ts (+219 -0)
➕ src/apkSignature/apkV1Signers.test.ts (+88 -0)
➕ src/apkSignature/apkV1Signers.ts (+208 -0)
📝 src/application/AnalysisProvider.ts (+27 -47)

...and 30 more files

📄 Description

Author readiness

Human owner: @uyg7x

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5211 **Author:** [@uyg7x](https://github.com/uyg7x) **Created:** 10/19/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `docs/apk-signature-grammar-final` --- ### 📝 Commits (10+) - [`f8ce23e`](https://github.com/morluto/rea/commit/f8ce23eddea2f73d9e9f84f03851fdae70f1442e) feat(apk): locate and frame the APK Signing Block (v2+ foundation) - [`40df3ad`](https://github.com/morluto/rea/commit/40df3adf8f6601b9319bc808b20299615a2fd434) feat(apk): decode v2/v3/v3.1 signer structures from the signing block - [`b2b95ab`](https://github.com/morluto/rea/commit/b2b95aba4e75e7e0e99062339356208a5d067fa1) feat(apk): detect v1 (JAR) signing from the central directory - [`f160be6`](https://github.com/morluto/rea/commit/f160be6dbb0213e37b71d190ac4bce6f34ab067a) feat(apk): public result schema and tamper-surface posture derivation - [`9cf1b9b`](https://github.com/morluto/rea/commit/9cf1b9b4865d92de57fe6be0162b50c610a50e12) feat(apk): provider, service and CLI/MCP/catalog wiring for inspect_apk_signature - [`da27214`](https://github.com/morluto/rea/commit/da272149bd7d7e58fb4f3609cae3a71f33676ffb) feat(apk): recompute the v2/v3 content digest for self-consistency - [`23108ca`](https://github.com/morluto/rea/commit/23108ca0a27b26622c5814ad7e349571d37fdf0b) feat(apk): decode the v3 rotation lineage; stop flagging rotation as tampering - [`f44068e`](https://github.com/morluto/rea/commit/f44068e46270e2761ba54a8c0d7e3f1c815cf102) test(apk): add the apksigner/aapt2 real-toolchain lane (verify:apk-signature) - [`023a838`](https://github.com/morluto/rea/commit/023a838c2cbd5706304b981ff7442d8621e5ebba) test(apk): SDK-free provider tests for inspect_apk_signature - [`addf92a`](https://github.com/morluto/rea/commit/addf92a9680677b223a9a537d654405f16435ec9) fix(apk): enforce the output budget and keep observed and declared facts apart ### 📊 Changes **50 files changed** (+8089 additions, -48 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+6 -0) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+17 -0) 📝 `README.md` (+26 -0) ➕ `docs/apk-signature.md` (+182 -0) 📝 `docs/architecture.mermaid` (+3 -0) 📝 `docs/index.md` (+11 -0) ➕ `docs/specs/apk-signature/spec.md` (+113 -0) 📝 `package.json` (+1 -0) 📝 `scripts/lib/catalog-builders.mjs` (+5 -0) 📝 `scripts/lib/catalog-core.mjs` (+3 -0) 📝 `scripts/lib/test-projects.mjs` (+1 -1) ➕ `scripts/verify-apk-signature.mjs` (+689 -0) ➕ `src/apkSignature/ApkSignatureProvider.test.ts` (+642 -0) ➕ `src/apkSignature/ApkSignatureProvider.ts` (+571 -0) ➕ `src/apkSignature/ApkSignatureRelease.ts` (+21 -0) ➕ `src/apkSignature/apkCertificateFacts.ts` (+65 -0) ➕ `src/apkSignature/apkSignatureFailures.ts` (+219 -0) ➕ `src/apkSignature/apkV1Signers.test.ts` (+88 -0) ➕ `src/apkSignature/apkV1Signers.ts` (+208 -0) 📝 `src/application/AnalysisProvider.ts` (+27 -47) _...and 30 more files_ </details> ### 📄 Description ## Author readiness Human owner: @uyg7x - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-11-01 21:43:14 +00:00

bsakaguchi referenced this issue

2026-11-03 13:39:50 +00:00

[PR #7203] [MERGED] fix(browser): keep opaque cookie partitions unaligned #7713

bsakaguchi changed title from ~~[PR #5211] Fix #4856: Prevent call stack overflow on large TOML files~~ to [PR #5211] [CLOSED] Fix #4856: Prevent call stack overflow on large TOML files

2026-11-04 18:29:43 +00:00

bsakaguchi closed this issue

2026-11-04 18:29:43 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6817

No description provided.

Rows
Columns