test(cf11): preserve raw archive integrity across divergent FHIR origins
CF11: offline regression for verified dual-origin IPS archive drift
On 2026-10-10 the official FHIR package origins served
two different raw TAR-gzip archives for the same apparent
package identity hl7.fhir.uv.ips@2.0.1:
| Origin | Raw SHA-256 | Archive bytes |
|---|---|---|
| packages.fhir.org | 7183242b70fb2a9058aa3701fb607517a3c2fd0e3100d1d8c538d744c2adf799 | 725312 |
| packages2.fhir.org/web | 5ebcb6d4bfbb32cd0b36b7d2165cb43c1aafc34e2849db3e37ecee07e7d781d2 | 749559 |
Both endpoints gave HTTP 200. Their real manifest
dependency sets match, but the manifest publishing
metadata and at least one TAR content member differ.
The full non-extracted content provenance is in
issue #214, comment 6099822219.
One-file bounded test
Adds a single synthetic no-network regression in
crates/commandf-pkg/tests/resolution.rs. It constructs
two small manifest-valid compressed packages with
identical name/version/dependencies/source ID but
different publication metadata and TAR members, then
proves that:
- Resolved roots, graph edges, package name/version,
declared dependency maps and source IDs are identical. - Raw archive digests and serialized lock bytes
remain different. - Both own caches verify successfully.
- Cross-verification against the OTHER origin's
digest-addressed cache fails closed in both directions.
There is no live package binary, license-sensitive
donor content or new dependency committed.
Qualification
- Pinned Rust 1.97.1 on authorized Mac.
- cargo test --locked -p commandf-pkg --test resolution:
9/9 PASS, including this new negative regression. - cargo fmt --all -- --check: PASS.
- cargo clippy --locked -p commandf-pkg
--test resolution -- -D warnings: PASS. - git diff --check: PASS.
- Candidate signed GitHub Verified+DCO
f3c0f00e0788dcd22df4637449f7c4651dae6de4. - No protected AF-02, workflow, Cargo manifest/lock,
runtime resolver or CI assertion change. - All exact-head required technical GitHub checks
and post-merge main assurance must pass; normal
expected-head merge only.
The observed dual-origin byte drift is REAL, but
the failing historical CI runs did not persist their
two different lockfiles. This is a demonstrated
mechanism, not proof of the exact failed CI field.
Issue #214 should remain OPEN pending a causal
match and a qualified registry policy/remediation.
Summary by cubic
Adds an offline regression proving the resolver keeps identical package identities from different origins distinct when their raw archive bytes differ.
The test builds two synthetic TAR-gzip packages with matching name, version, dependencies, and source ID but divergent manifest metadata and TAR members, then verifies that resolved graphs stay equivalent while raw digests and lock bytes differ, and that each origin's cache rejects the other's archive. It also covers a new case: writing the wrong archive bytes into a cache under the expected digest fails closed with a CacheDigestMismatch error, so missing cross-origin objects are not confused with actual content tampering. This reproduces the byte drift observed for hl7.fhir.uv.ips@2.0.1 in issue #214.