[GH-ISSUE #2330] fix(artifacts): correct ZIP non-entry coverage description #769

New issue

Closed

opened 2026-10-15 18:28:11 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:11 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2330

ZIP_NON_ENTRY_TAIL_LIMITATION says bytes after the central directory include an APK Signing Block. The APK v2 signing block actually precedes the central directory. The inventory omits non-entry data on either side, so the current explanation can mislead an analyst about examined coverage.

The canonical limitation is shared by inventory and artifact comparison; its wording must be corrected at its owner rather than patched downstream.

Primary reference: https://source.android.com/docs/security/features/apksigning/v2#apk-signing-block

Acceptance:

Describe omitted data regardless of its position relative to the central directory.
Keep the existing public constant name and comparison behavior compatible.
Verify through real archive inventory that ZIP comments do not become occurrences, while whole-file hashes distinguish otherwise equal archives.
Run focused boundary tests and static checks.

Plan: docs/specs/001-zip-inventory-coverage/. This changes reporting only; no execution, mutation, extraction or signature verification capability is added.

Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2330 `ZIP_NON_ENTRY_TAIL_LIMITATION` says bytes after the central directory include an APK Signing Block. The APK v2 signing block actually precedes the central directory. The inventory omits non-entry data on either side, so the current explanation can mislead an analyst about examined coverage. The canonical limitation is shared by inventory and artifact comparison; its wording must be corrected at its owner rather than patched downstream. Primary reference: https://source.android.com/docs/security/features/apksigning/v2#apk-signing-block Acceptance: - [ ] Describe omitted data regardless of its position relative to the central directory. - [ ] Keep the existing public constant name and comparison behavior compatible. - [ ] Verify through real archive inventory that ZIP comments do not become occurrences, while whole-file hashes distinguish otherwise equal archives. - [ ] Run focused boundary tests and static checks. Plan: `docs/specs/001-zip-inventory-coverage/`. This changes reporting only; no execution, mutation, extraction or signature verification capability is added.

bsakaguchi

2026-10-15 18:28:11 +00:00

closed this issue
added the
area: domain

bug

P2: medium
labels

bsakaguchi commented

2026-10-15 18:28:12 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in 3cb9d61ec.

ZIP comparison describes non-entry/signing-block coverage accurately.

Validation: Eleven artifact comparison boundary tests passed, including non-entry archive byte coverage; static gate passed.

Verification scope: None identified in source audit; exact workload not separately run.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [3cb9d61ec](https://github.com/morluto/rea/commit/3cb9d61ec). ZIP comparison describes non-entry/signing-block coverage accurately. Validation: Eleven artifact comparison boundary tests passed, including non-entry archive byte coverage; static gate passed. Verification scope: None identified in source audit; exact workload not separately run.

bsakaguchi referenced this issue

2026-10-16 21:15:45 +00:00

[PR #752] [MERGED] fix(javascript): keep mutated object initializer values unknown #2214

bsakaguchi referenced this issue

2026-10-16 21:15:58 +00:00

[PR #769] [MERGED] fix(semantics): recognize Node builtin default namespaces #2229

bsakaguchi referenced this issue

2026-10-16 21:16:27 +00:00

[PR #815] [MERGED] fix: integrate 24 reviewed browser/native/semantics corrections #2262