fix(cache): bound verified archive reads (signed DCO replacement)

Merged
TH
12d ago
+75-12

Signed replacement for security repair #197 — issue #196

The original PR #197 is technically green but its API-created commit was unsigned and lacks a DCO signoff. This PR supplies the identical final Git tree using a single fresh signed, DCO-compliant commit on canonical protected main. No rebases, force pushes, branch history rewrites, or hidden source changes.

  • Signed commit: 79ef45f787fbd3b71403b306117dc0acb46f4370 (GitHub reports verified=true, reason=valid).
  • DCO: Signed-off-by: Abdulaziz M. Shehri <alshehriofficial@gmail.com>.
  • Base: f82565cca917d119e1c774b2c470e2ac20e0d6dd.
  • Content tree: d0326694e4679fb1f7ccb6ef566e6523da759d28, byte-identical to #197 head fee0b917fc28b4def5d38e99969efdc2fb3ff836.
  • Local verification on authorized Windows PC: applied original #197 patch to a shallow canonical-main checkout, cargo fmt --all -- --check PASS, git diff --cached --check PASS, exact tree matched, git commit -S -s succeeded; restored previous active GitHub CLI account after pushing the new branch.

Scoped repair

PackageCache::read_verified previously used unbounded fs::read on a local cached FHIR package object. The repair enforces the shared 128 MiB compressed-archive ceiling, rejects oversized sparse files via opened-file metadata before allocation, retains a take(limit+1) growth probe, clamps caller-supplied larger budgets and rejects oversized insertions. Exact SHA-256/cache path semantics and FHIR compatibility authority are preserved. Tests cover exact/+1 bounds, sparse over-limit and attempts to bypass the global cap.

Qualification still required on this SHA

Original #197 has 15/15 successful technical CI checks, but those conclusions are not automatically transferable across commits. Require a new 15/15 technical qualification on this signed SHA, a genuine independent human Code Owner APPROVED review with last-push validity, thread resolution, normal merge commit, then fresh-main CI. Bot NEUTRAL/COMMENTED and author self-review do not satisfy protection. Keep #196 open until actually merged and qualified.

No change to AF-02 protected authority, locked FHIR oracle, dependencies, workflows or branch rules. Do not call this a full CommandF release. #197 will be archived separately as superseded without merge, preserving its historical CI evidence and commit history.

Summary by cubic

Bounds verified package cache reads to the shared 128 MiB compressed-archive ceiling so oversize or sparse objects fail before allocation instead of being read fully into memory.

  • read_verified now uses the bounded reader with the global archive limit, and put rejects oversize insertions.
  • Caller-supplied limits are clamped to the cap, with the file metadata checked before allocation and a take(limit + 1) growth probe retained.
  • Added tests for exact and overflow bounds, sparse oversize objects, and attempts to bypass the global cap.