morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #8872] [Bug] function Evidence export omits linked Ghidra source records #7780

New issue

Open

opened 2026-11-04 07:00:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-04 07:00:20 +00:00

Owner

Originally created by @morluto on GitHub (Nov 4, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8872

Before submitting

I searched open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

rea function --evidence_output returned success and wrote a bundle containing the function observation but not its linked Ghidra historical-analysis health Evidence. The CLI describes this option as saving complete Evidence. The omitted record was available during the one-shot session, but its exact contents were not delivered in the output or bundle.

Reproduction

On #8870 head e62484931, configure Ghidra to use a caller-owned existing project containing an analysis-history report, then run:

rea function <target> 0x1000003e0 --provider ghidra --evidence_output <new-bundle-path> --format json --full-output

The command exited 0 and returned analyze_function Evidence ev_da821a3e6cc9811dcf4d00d397d6fae67fd78a494c9b8fc0a8e4b98e0aec8ba9, linking ev_95109c69c3c3a6741a1bd2ae3100dcc368f072b9eefbb9a9a2f96dc83700eaec. The 19,382-byte bundle contained one record, the function observation, and no record for that linked ID. The report in this fixture is synthetic. The target SHA-256 and selected .gpr descriptor hash matched the values recorded before this control; the project directory as a whole was not independently hashed.

Expected behavior

Preserve the exact transitive source closure when the caller explicitly selects an Evidence bundle, or report an actionable failure or explicit omission before claiming successful complete delivery. Do not silently change Evidence identity or write an unrequested file.

Impact and scope

A successful export cannot independently resolve its cited historical source, which could change before a later run. This is stronger than the default-output availability concern in #8590: a bundle was explicitly requested and successfully published. #8285 concerns a different command without an advertised export option. Only function and one real Ghidra existing-project fixture were exercised. Both complete and --detail summary JSON delivery exited 0 and wrote a bundle with the same missing health source. Other commands, providers, cancellation and cleanup failure are unverified.

REA version

#8870 head e62484931c2b19463e2adf5fceacdf6fbb7485e8. The CLI command, delivery adapter and source collector files have no diff against the checkout's origin/main; the runtime test was performed on the PR head, not independently on main.

Runtime and platform

macOS arm64, Node 24.22.1, Ghidra 12.1.4, JDK 21.

Target and artifact context

Source-built Mach-O SHA-256 510a23fc3c152175b9977130b3b1711d580e47d22a085cdee6a4e0c9dea2c51a; target not executed. Existing project contains a deliberately synthetic historical report.

Interface

CLI

Earliest failure stage

One-shot Evidence bundle publication.

Relevant output or evidence

The result links the historical health ID; the saved bundle contains only the analyze_function ID. The selected project descriptor SHA-256 was e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 before and after.

Typed outcome or recovery expected

NOT_ENOUGH_INFO: select an explicit source-closure delivery contract and test successful publication, incomplete source closure, snapshot replay, cancellation, and failed cleanup. The caller should be able to distinguish a complete bundle from one with unavailable cited sources.

Analysis or suspected cause

Source-derived: runDirectAnalysis returns the parent Evidence after the one-shot session closes. function passes that parent to publishCliAnalysisEvidence without sourceEvidence; analysisEvidenceSources collects embedded sources for artifact inspection, not Ghidra session sources. Validate the producing session and delivery ownership together rather than inferring the source can be reconstructed later.

Additional context

cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

Originally created by @morluto on GitHub (Nov 4, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8872 ### Before submitting - [x] I searched open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `rea function --evidence_output` returned success and wrote a bundle containing the function observation but not its linked Ghidra historical-analysis `health` Evidence. The CLI describes this option as saving complete Evidence. The omitted record was available during the one-shot session, but its exact contents were not delivered in the output or bundle. ### Reproduction On #8870 head `e62484931`, configure Ghidra to use a caller-owned existing project containing an analysis-history report, then run: ```sh rea function <target> 0x1000003e0 --provider ghidra --evidence_output <new-bundle-path> --format json --full-output ``` The command exited 0 and returned `analyze_function` Evidence `ev_da821a3e6cc9811dcf4d00d397d6fae67fd78a494c9b8fc0a8e4b98e0aec8ba9`, linking `ev_95109c69c3c3a6741a1bd2ae3100dcc368f072b9eefbb9a9a2f96dc83700eaec`. The 19,382-byte bundle contained one record, the function observation, and no record for that linked ID. The report in this fixture is synthetic. The target SHA-256 and selected `.gpr` descriptor hash matched the values recorded before this control; the project directory as a whole was not independently hashed. ### Expected behavior Preserve the exact transitive source closure when the caller explicitly selects an Evidence bundle, or report an actionable failure or explicit omission before claiming successful complete delivery. Do not silently change Evidence identity or write an unrequested file. ### Impact and scope A successful export cannot independently resolve its cited historical source, which could change before a later run. This is stronger than the default-output availability concern in #8590: a bundle was explicitly requested and successfully published. #8285 concerns a different command without an advertised export option. Only `function` and one real Ghidra existing-project fixture were exercised. Both complete and `--detail summary` JSON delivery exited 0 and wrote a bundle with the same missing `health` source. Other commands, providers, cancellation and cleanup failure are unverified. ### REA version #8870 head `e62484931c2b19463e2adf5fceacdf6fbb7485e8`. The CLI command, delivery adapter and source collector files have no diff against the checkout's `origin/main`; the runtime test was performed on the PR head, not independently on main. ### Runtime and platform macOS arm64, Node 24.22.1, Ghidra 12.1.4, JDK 21. ### Target and artifact context Source-built Mach-O SHA-256 `510a23fc3c152175b9977130b3b1711d580e47d22a085cdee6a4e0c9dea2c51a`; target not executed. Existing project contains a deliberately synthetic historical report. ### Interface CLI ### Earliest failure stage One-shot Evidence bundle publication. ### Relevant output or evidence The result links the historical `health` ID; the saved bundle contains only the `analyze_function` ID. The selected project descriptor SHA-256 was `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` before and after. ### Typed outcome or recovery expected NOT_ENOUGH_INFO: select an explicit source-closure delivery contract and test successful publication, incomplete source closure, snapshot replay, cancellation, and failed cleanup. The caller should be able to distinguish a complete bundle from one with unavailable cited sources. ### Analysis or suspected cause Source-derived: `runDirectAnalysis` returns the parent Evidence after the one-shot session closes. `function` passes that parent to `publishCliAnalysisEvidence` without `sourceEvidence`; `analysisEvidenceSources` collects embedded sources for artifact inspection, not Ghidra session sources. Validate the producing session and delivery ownership together rather than inferring the source can be reconstructed later. ### Additional context cc @gensokyo-dev @kaoru0822-kitauji @N0zoM1z0

bsakaguchi referenced this issue

2026-11-04 11:18:36 +00:00

[PR #7065] [CLOSED] feat(artifacts): read Zstandard-compressed ZIP members #7620

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7780

No description provided.

Rows
Columns