Lane A (A.17-A.18): the deterministic comparator, and a corpus that is provably what it claims

[tom-snyder]

Summary

A.17 implements the version comparator the whole lane exists to feed; A.18 reviewed it and returned FAIL — 3 blockers, 6 majors. Two more rounds followed. This is the result.

What it refuses matters more than what it covers

internal/match implements dpkg, rpmvercmp and apk, and refuses everything else by name: npm, PyPI, Go, Maven, NuGet, Cargo — and semver as a scheme. No fallback anywhere, and a test asserts the refusal also returns 0, so a caller that ignores the error gets nothing that looks like an answer.

That's the important property. A silently wrong CVE match either tells someone they're safe when they aren't, or floods them until they stop reading any of it. Refusing is the only honest third option.

The three scheme implementations were compared statement-by-statement against dpkg's verrevcmp/order and rpm's rpmvercmp and found faithful — every defect was in the layers above the comparison.

Three blockers, and one fix that over-corrected

• An empty advisory cache reported a clean host. AssertNotSilentlyClean never read PackagesWithNoAdvisoryData — the field whose own doc says it exists for that. The silent-clean failure mode, inside the guard named for preventing it.
• An epoch spelled on one side only silently cleared a live vulnerability, on RHEL's routine shape. Now a typed refusal, with ordering left untouched and a test pinning that the two rules can't later be collapsed into one.
• The identity check accepted a name it then failed to look up — and the fix over-corrected into a second silent clean, because the purl name won unconditionally, so a purl naming a different package was accepted. The rule is now the one already applied to ecosystem and version: identical-after-ASCII-fold is a spelling and canonicalises; a different name is a conflict.

The test couldn't have caught that: it varied only the reported name across spellings of one package, so it exercised the fold and never the disagreement. Its doc now says what it doesn't cover, and the new test varies the purl name — the axis that never moved.

A refused range also still decided by absence, re-arming the exact backport false positive the lane exists to defeat, while the doc asserted the opposite invariant.

The corpus is now true by construction, not by wording

Twice the header overstated what had been transcribed — the second time in the same section. The first instance was the sharpest form of it: the rpm corpus stopped exactly where the implementation would fail, so the provenance claim made a truncated set read as exhaustive.

That's the third time on this project a provenance or compliance claim has been corrected and stayed false. Patching the wording a third time wasn't the fix.

So provenance is now structural: every vector is TRANSCRIBED (carrying file and line) or AUTHORED (carrying the rule it encodes), with disjoint required fields and no third state. Completeness claims are data carrying their count, and a test fails in either direction, fails on duplicate loci so a short corpus can't be padded, and fails if a transcribed vector's source carries no counted claim.

The corpus is the replay now, not a summary of it:

Source	Rows	Result
rpm tests/rpmvercmp.at	all 91 active RPMVERCMP lines	86 pass, 5 refused, 0 wrong
dpkg scripts/t/Dpkg_Version.t	all 43 __DATA__ rows	43 pass
apk-tools test/unit/version.data	all 738 ordering rows + 31 validity	674 pass, 64 refused, 0 wrong

Three vectors falsely cited to Dpkg_Version.t are re-tagged AUTHORED. rpm_compare.go claimed four separator-only vectors; there are five, and it no longer makes a completeness claim at all.

apk R7a justified a refusal by asserting a tokeniser mechanism that is false against the file it cited. src/version.c actually falls back to string sort on a leading zero, and the published fixture line 735 has 8.2.0015 < 8.2.002 — which numeric comparison orders the other way. Justified from the real text now.

AssertNotSilentlyClean couldn't be made the sufficient statistic its doc promised, so the doc was narrowed and the over-promising sentence deleted rather than softened — and every sentence of the new contract, the negative ones included, is asserted by a test.

Testing

gofmt / vet / build   clean
go test -count=1      green across 21 packages, no t.Skip added

Determinism proven across six separate OS processes — and it earned that: one mutation was caught by child 2 and not child 1, which is precisely why a single-process repeat wouldn't have done. Every fix verified RED against the pre-fix behaviour before being trusted.