security: bound direct SBOM archive input before parser execution - #68

Draft

seonghobae wants to merge 19 commits into

release/sealed-evidence-preparationfrom

security/bound-sbom-archive-input

Commits on Aug 6, 2026

test: reproduce unbounded direct SBOM archive parsing
seonghobae
committed
dd8f311
test: reach direct archive parser regressions
seonghobae
committed
22e8764
security: preflight release archives before parsing
seonghobae
committed
bb15de9
test: bind direct SBOM compressed archive limit
seonghobae
committed
89a0512
docs: document direct SBOM archive bounds
seonghobae
committed
8a14fd9
chore: record direct SBOM archive preflight
seonghobae
committed
989959e
test: require descriptor-bound SBOM archive reads
seonghobae
committed
dd3f8e7
security: bind SBOM parsing to preflighted archive
seonghobae
committed
e839aa1
docs: document descriptor-bound SBOM verification
seonghobae
committed
d037f24
fix: preserve SBOM hashing contract name
seonghobae
committed
01a3159
test: reproduce CLI symlink and live parser growth bypasses
seonghobae
committed
39f601c
test: make parser-growth RED fixtures lint-clean
seonghobae
committed
7debd03
security: live-bound archive parser descriptor
seonghobae
committed
eecaaa3
docs: document live-bounded archive parsing
seonghobae
committed
faa3939
test: pin parser live-read bounds
seonghobae
committed
f232731
fix: cap parser reads to remaining artifact bytes
seonghobae
committed
ecf15d7
Merge release/sealed-evidence-preparation into security/bound-sbom-archive-input
seonghobae
committed
224e6d2
test: reject unsafe parser offsets and descriptor failures
seonghobae
committed
d5e073f
security: normalize bounded parser stream state
seonghobae
committed
127e457