fix(mirror): reject oversized archive reads (signed DCO)

Merged
TH
8d ago
+43-4

Signed, DCO-compliant replacement for PR #201 — issue #200

This is a new single signed commit from the unchanged protected V2 main f82565cca917d119e1c774b2c470e2ac20e0d6dd. The original PR #201 is technically qualified but has unsigned GitHub-API-created commit history. This candidate reproduces its identical Git content tree, without force-push, rebasing, history rewriting, changing FHIR semantics or touching protected rules.

  • Signed commit: 94023a81e614c5bf6bef29bab9e2cf7a8da0725a, live GitHub API verification.verified=true, reason=valid.
  • DCO: Signed-off-by: Abdulaziz M. Shehri <alshehriofficial@gmail.com>.
  • Exact content tree: b5c79c0d379e49ffdc6739a678e0746b3369143b (byte-identical to old PR #201 head).
  • Parent: f82565cca917d119e1c774b2c470e2ac20e0d6dd.
  • Windows evidence: verified online Abdulaziz device, temporary shallow checkout from canonical main, fetched immutable original PR head, git apply --check, git diff --cached --check, cargo fmt --all -- --check PASS; exact git write-tree equality checked before and after git commit -S -s. Pushed one new branch with normal Git push; original worktree not modified. Original GitHub CLI account restored.

Scope

For local mirror FHIR package acquisition, reject known >128 MiB archive files from opened-file metadata before buffered reading, retain a bound+1 probe against file growth and the canonical acquisition size ceiling. Synthetic regressions cover sparse oversize, exact limit and excessively large caller budgets.

Mandatory remaining gates

The original PR #201 had 15/15 technical SUCCESS at its own SHA; that does not qualify this new commit. Run all exact-head GitHub required checks independently on 94023a81e614c5bf6bef29bab9e2cf7a8da0725a and acquire one genuine independent eligible human Code Owner APPROVED review after the last push, resolve review threads, normal merge commit, then verify fresh-main CI. Do not treat bot COMMENTED/NEUTRAL or the user's generic continuation as approval or FD-1/FD-2 exception. Keep issue #200 open until actually merged and proven on main. Full consumer contract decision and signed/atomic receipts remain separate unfinished work.

Summary by cubic

Rejects oversized mirror archives before reading their contents. read_limited_archive now checks the file size from metadata first, so sparse oversized files fail immediately instead of after a bounded read; the streaming check stays for files that grow between metadata and read.