fix(xanmod): reject unterminated ownership proof tails - #48
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reject nonempty unterminated third-line ownership-proof tails in both XanMod implementations. Bash read returns nonzero at EOF even after consuming tail bytes.
Scope
Only tools/xanmod-install.sh, modules/system-customize.sh, tests/test-xanmod.sh. Independent of #47. Baseline main: 44acbd5. No workflow or deployment changes.
Validation
Tests cover valid two lines, complete/empty third line and unterminated text tails. The real cleanup dispatcher is exercised with a deletion spy for candidate state and PROOF_OWNED=false, both with candidate present and absent. Assert all six allocation-state fields reset, no deletion call, and untrusted objects retained. Prior-ownership/residue cleanup is a distinct existing contract; this test does not claim it prevents deletion in every state.
Old-parser counterexample copies the old EOF logic into an inert fixture; it is not execution of a historical checkout. Existing tests compare shared module/tool functions. Previous HEAD 944e17b passed both environments; latest state-assertion commit requires fresh CI. Expected suites: MOTD and XanMod.
Risks and rollback
Intentional stricter rejection of malformed text proofs; no arbitrary-deletion exploit claim or byte-exact binary-parser claim. Revert this PR to roll back. No production configuration/SSH/APT/services operated, no credentials supplied to tests. Draft, no merge; explicit user merge confirmation remains required.