fix(pkg): reject duplicate TAR manifests with bounded full scan

Merged
TH
8d ago
+78-2

Confirmed defect and fix (#219)

The V2 package manifest parser returned the first TAR entry named
package/package.json without checking later entries. A crafted archive
could therefore contain two independently valid but contradictory
manifests. A regression test on unchanged main first FAILED (it
observed Ok(PackageManifest) instead of the required error).

This candidate scans the remaining bounded TAR entries after the
first manifest, rejects a second normalized manifest identity, and
preserves the existing manifest-body, entry-count and decompression
budgets. It does not select the first or last entry arbitrarily.

The only source change is
crates/commandf-pkg/src/archive.rs (78 insertions, 2 deletions).
It adds tests for matching and conflicting duplicate manifests,
./ normalized path alias, ordinary trailing resources, post-manifest
entry count and post-manifest decompression budget. No protected AF-02
paths, Cargo files, CI workflows, repository identity, or review
rules were changed.

Qualification on authorized macbook (Darwin)

  • Original defect: red reproduction on unmodified reader.
  • Archive regression tests: 9/9 PASS.
  • Package library tests: 81 PASS, 2 pre-existing ignored.
  • Resolver integration: 7/7 PASS.
  • cargo +1.97.1 clippy --locked -p commandf-pkg --lib -- -D warnings:
    PASS.
  • Cargo format check and Git whitespace diff check: PASS.
  • Real hl7.fhir.uv.ips@2.0.1 network resolution: 9 exact
    packages resolved and cache-verified    , lock SHA-256
    84e8d8132624b0f049e145f871bcefa68fa86cdb5306ed340b4c8e9e6eb8bb02,
    identical to prior successful primary-source Mac resolutions.
  • Real official us.nlm.vsac@0.24.0 (78,238,082 compressed
    bytes) inspected without extracting: 16,702 entries, manifest
    last, ~905.7 MB decompressed, within the unchanged
    896 MiB/939,524,096-byte budget.
  • Crucially, the modified CommandF binary resolved and verified
    the real VSAC tarball and its hl7.fhir.r4.core@4.0.1 dependency
    from a local mirror containing the exact previously captured
    archives: two packages verified, no network during run.
    Mac elapsed ~49 sec. Evidence files retained only outside repo.

Merge and review boundary

GitHub-native forward signed commit:
4c3c7115f51338f267346234a3797b2e0860f45f,
verified=true, reason=valid, author-matched DCO.
Check exact-head CI and independent human Code Owner approval under
#195 before a normal merge commit. Do not treat bot comments,
simulated review, unsigned evidence or self-approval as qualified.

Real-world exploitation is not alleged, nor is global project
completion. This is one testable fail-closed TAR ambiguity fix.

Summary by cubic

Fixes the V2 package manifest parser returning the first package/package.json TAR entry without checking the rest, so archives with duplicate manifests are now rejected instead of silently accepting the first one. Fixes #219.

  • Scans the remaining bounded TAR entries after the first manifest and rejects a second normalized manifest path with InvalidRequest, covering identical and conflicting duplicates plus ./ path aliases.
  • Keeps the existing manifest-size, entry-count, and decompression budgets unchanged.
  • Adds tests for accepted single-manifest archives, duplicate rejection, and post-manifest budget enforcement in crates/commandf-pkg/src/archive.rs.