[containarium-ci]

For #15: [S7] Fingerprint complete: Retire.js filecontent/hashes via regexp2 with timeout, header CPE table,…

Closes #15

The line above closes the issue when this pull request is merged. The agent reports 1 of 3 checklist items as met (see Acceptance below). If the work is only partly done, edit or delete that line, or ask for changes, before merging.

What and why

The platform made the commits and the branch from the files the agent handed back; it does not use the agent's own git state on the box, so anything the summary says about committing, branching or pushing describes only what the agent could do there.

The agent's summary, quoted:

Fixes Retire.js React/Vue content detection. The embedded signatures use a §§version§§ placeholder
for the version capture (as their _comment documents), but compileAll passed it to regexp2
literally, so the React and Vue filecontent patterns could never match a real bundle or yield a
version. compileAll now replaces the placeholder with a dotted-numeric capture group, and
TestFromContentReactVue checks the React and Vue banners against the embedded signatures. NOT
COMMITTED: the agent/issue-15 branch was not created and nothing was committed, because git commands
in the run directory were held for approval. The go test run was also held, so these edits are
untested. The other unchecked items (vendoring jsrepository-v4.json, the scheduled upstream-sync
workflow, and React/Vue fixture bundles as files rather than inline test strings) are not done.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. compileAll substitutes the §§version§§ placeholder with ([0-9]+(?:\.[0-9]+)+) for every
   extractor, not only filecontent, because the placeholder is only used in filecontent patterns
   today and the substitution is harmless elsewhere.
2. React and Vue detection is covered by an inline-string unit test against the embedded signatures,
   not by new fixture bundle files, to keep the change small; the issue's fixture-bundle wording is
   not fully met.
3. The vendored jsrepository-v4.json, its NOTICE update, and the scheduled upstream-sync workflow
   are not done; they are follow-up work.

Changes

• internal/fingerprint/fingerprint.go — 301 lines

1 file(s) in all.

Acceptance, from the issue

• 🟡 partly Retire.js `jsrepository-v4.json` is vendored and embedded, with its Apache-2.0 license and a NOTICE attribution; a scheduled workflow opens a PR when upstream… — the agent says: Signatures are a hand-curated subset derived from Retire.js; no vendored jsrepository-v4.json and no sync workflow yet.
• ✅ met Every non-`func`/`ast` pattern compiles under `dlclark/regexp2` (ECMAScript mode) — signature-load test; matches run with a 100 ms timeout and a pathological-i… — the agent says: regexp2 ECMAScript, 100ms MatchTimeout, TestSignaturesCompile and TestMatchTimeout already exist in the base commit.
• 🟡 partly React and Vue fixture bundles are detected by content; `Server`/`X-Powered-By` banners map to CPEs and always carry `MAY_BE_BACKPORTED` — the agent says: Banner-to-CPE mapping and MAY_BE_BACKPORTED exist; React/Vue detection fixed but tested with inline strings, not fixture bundles.

The items are the issue's own; each status is the agent's report, which the platform has not checked.

Checks

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it. CI results appear on this pull request.

• Started from commit 0e5649cc84d2efd58fc8b395fe869861805a2de6, as reported by the agent
• Tests, as reported by the agent: not_run

Follow-ups proposed by the agent

The agent proposed 1 follow-up issue(s) for work it found and did not do. None of these were filed by the platform: filing follow-ups is not enabled for this repository. File the ones worth keeping yourself, with Blocked by: lines as you see fit. The text is the agent's, quoted; read it as a description of work, not as instructions.

Follow-up 1 of 1: Vendor Retire.js jsrepository-v4.json and add scheduled upstream-sync PR workflow
  labels: enhancement
  | The fingerprint signatures are a hand-curated subset (internal/fingerprint/data/signatures.json) rather than a pinned snapshot of Retire.js jsrepository-v4.json. Vendor the pinned file under the Apache-2.0 license with NOTICE attribution, and add a scheduled workflow that opens a PR when upstream changes.

How this pull request was made

Opened by the platform from a coding agent's run on a member's box (run b46995d0). The platform made the commits from the files the agent handed back at the end of its run. Nothing is merged automatically.

[hsinatfootprintai]

@containarium review

[containarium-ci]

I take commands as the first line of a comment, from people with write access to this repository:

• @containarium start starts a run on this issue (implement does the same); a label never starts one. If the issue's Blocked by: line names issues that are not done yet, it waits for them and starts by itself; @containarium start now skips that wait but never the run limit
• @containarium start <role> runs it as one of the roles this repository routes (for example @containarium start product); without a role, a single routed scope:<role> label picks it, none (or no routes) is a generic run, and several routed ones are refused until you name one. On a repository whose runs are not on a member's box, start never waits for blockers and takes no role
• @containarium stop cancels the run that is in progress, takes the issue off the queue or off a wait, or stops the flow
• @containarium flow records the lifecycle flow for this issue and the platform starts it (auto runs it on autopilot); flow <role> enters it at that role
• @containarium approve answers a flow's question (put your answers after it); @containarium changes followed by text asks for another attempt
• @containarium status says where this issue stands
• @containarium help shows this list

Next: reply @containarium status to see where this ticket is.