Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

conformance: harden URI, explicit-null, and string-digest checks in TR-RTE, TR-ANC, TR-TXN, TR-SCA, and TR-POL

Open
  • Is something wrong?
#570 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@drk-ram is already working on this.

Since Oct 19, 2026.

  • #576 by @drk-ram — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security, testing

Research direction

Start with conformance/src/trace_tests/modules/tr_rte.py, tr_anc.py, tr_txn.py, tr_sca.py, and tr_pol.py, using schema/trace-claim.json as the validation reference. Locate the named conformance checks and existing tests or fixtures for URI, explicit-null, and digest handling. Done means malformed or schema-invalid values produce Status.FAIL, missing optional fields alone produce Status.SKIP, and valid records retain their existing results.

Written by the indexing model from the issue text.

Description

What is wrong

Contributor: Raghuvar Durga (@drk-ram)

On main (e1560f3), four conformance modules in conformance/src/trace_tests/modules/ have URI, explicit-null, and non-string digest coercion gaps that allow schema-invalid records to pass or skip conformance checks:

  1. TR-RTE-003 (conformance/src/trace_tests/modules/tr_rte.py, lines 90-104):

    • Checks only if rim_uri is None: Status.SKIP and elif isinstance(rim_uri, str) and rim_uri.startswith("https://"): Status.PASS.
    • As a result:
      • Explicit {"rim_uri": None} (null in JSON, which fails schema/trace-claim.json because runtime.rim_uri is "type": "string") returns Status.SKIP instead of Status.FAIL (unlike TR-APR-003 and TR-APR-004, which fail on explicit null).
      • rim_uri = "https://" (empty authority/host), rim_uri = "https://ex ample.com/rim" (contains whitespace), rim_uri = "https://example.com/\x01" (contains control characters), and rim_uri = "https://[" (unparseable IPv6 host) all return Status.PASS!

  2. TR-ANC-001 (conformance/src/trace_tests/modules/tr_anc.py, lines 21-42):

    • Uses urlparse(transparency) and checks only parsed.scheme != "https" or not parsed.netloc.
    • Because urllib.parse.urlparse does not reject whitespace or control characters, transparency = "https://rekor.sigstore.dev/api/v1/log/entries/bad uri" or "https://rekor.sigstore.dev/api/v1/log/entries/x\n" returns Status.PASS on TR-ANC-001 (whereas TR-POL-003 and TR-APR-002/003 explicitly reject whitespace and control characters).

  3. TR-TXN-002 (conformance/src/trace_tests/modules/tr_txn.py, lines 31-34):

    • Checks call_count = txn.get("call_count"); if call_count is None: Status.SKIP.
    • When "call_count": null is explicitly present in tool_transcript ("call_count" in txn and txn["call_count"] is None), schema/trace-claim.json rejects it ("type": "integer"), but TR-TXN-002 returns Status.SKIP instead of Status.FAIL.

  4. Non-string digest coercion via str(...) in TR-RTE-002, TR-SCA-002, TR-TXN-001, and TR-POL-001:

    • tr_rte.py (_DIGEST_RE.fullmatch(str(measurement))), tr_sca.py (_DIGEST_RE.fullmatch(str(digest))), tr_txn.py (_DIGEST_RE.fullmatch(str(h))), and tr_pol.py (_DIGEST_RE.fullmatch(str(bundle_hash))) coerce non-strings via str(...) before matching _DIGEST_RE, instead of requiring isinstance(..., str).

Spec section or file

  • conformance/src/trace_tests/modules/tr_rte.py (TR-RTE-002, TR-RTE-003)
  • conformance/src/trace_tests/modules/tr_anc.py (TR-ANC-001)
  • conformance/src/trace_tests/modules/tr_txn.py (TR-TXN-001, TR-TXN-002)
  • conformance/src/trace_tests/modules/tr_sca.py (TR-SCA-002)
  • conformance/src/trace_tests/modules/tr_pol.py (TR-POL-001)

Expected behavior

  1. TR-RTE-003 should skip only when "rim_uri" not in runtime, fail when rim_uri is None or not a str, and require a valid https URI with non-empty host (netloc) and no whitespace or control characters.
  2. TR-ANC-001 should reject transparency URIs containing whitespace or control characters with Status.FAIL.
  3. TR-TXN-002 should skip only when "call_count" not in txn, and fail with Status.FAIL when "call_count" is explicitly None.
  4. TR-RTE-002, TR-SCA-002, TR-TXN-001, and TR-POL-001 should require isinstance(value, str) before matching _DIGEST_RE.

Impact

Prevents trace-tests from passing malformed runtime.rim_uri ("https://" or URIs with spaces/control characters) and transparency URIs with spaces/control characters, or skipping explicit null values on runtime.rim_uri and tool_transcript.call_count.

Dominant language
Python
Stars
37
Forks
33
Avg merge
1d 4h
Merged PRs (30d)
122

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentrust-io/trace-spec

All issues in agentrust-io/trace-spec

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.