RFC 5280 4.1 defines an Extension as extnID, an optional critical
BOOLEAN and an extnValue OCTET STRING. Section 4.2 says a certificate
MUST NOT include more than one instance of an extension.
The decoder only checked that extensions were a SEQUENCE. Any entry,
and any repeat, was accepted.
* fix(artifacts): own source errors during output setup
* fix(artifacts): join silent source destruction before returning
* fix(artifacts): retain source cleanup failures with primary errors
* fix(artifacts): join source finalization and classify secondary failures
* fix(firmware): separate source cleanup from output rollback
* fix(artifacts): retain live source cleanup dependencies
* fix(artifacts): preserve source failure completion and semantics
* fix(artifacts): retain scope cleanup owners and typed failures
* fix(artifacts): keep cleanup classification and admission recovery
When the operation completed and only scope cleanup failed, keep the cleanup failure's own reason instead of reporting io, matching main (fixes artifactProvider.cleanupRetry). When a typed primary is rebuilt with pending scope cleanup, carry its userMessage and ASAR header admission so callers keep the configured ceiling and setting.
* fix(artifacts): translate plain file-close failures through the reader path
The outer file-cleanup branch rebuilt every ArtifactFileCleanupFailure as a
ProviderAdapterError, so dyld reads lost their io, unavailable, format and
cancelled reasons and their exact file-cleanup cause. Compose separately only
when the failed primary owns its own translation (a domain error, source
failure or scope cleanup failure); raw and reader primaries are already
projected by the file failure with its exact lease.
* fix(artifacts): bound source destruction by cancellation and keep wrapper admission
After cancellation, SafeOutputTree.write could wait indefinitely for a source
whose destruction did not settle, both in the destroy join and in the
iterator's wait for close. Both waits now end at cancellation plus a fixed 1 s
grace, modeled on the process-output closure grace. A destruction that
outlives it is reported as incomplete source cleanup under an exact lease that
releases only once closure is observed without a late error.
ArtifactResourceCleanupFailure and SafeOutputSourceFailure now keep the
primary's admission, matching withCleanup.
* fix(artifacts): keep one settled wait while observing a stuck source
observeClosure raced the same pending close promise against a new timer every
10 ms, so a source whose destruction never settled accumulated one reaction per
poll for as long as it stayed open. Each poll now waits on its own promise that
the close listener or the unref'd timer settles, leaving one pending wait and
one close listener. The lifecycle test also asserts that a late close releases
the retained owner without an explicit retry.
* fix(artifacts): settle pending reads before cancellation
* test(artifacts): observe the consumed ZIP iterator on cancellation
* test(artifacts): validate projected cleanup resources before sorting
* test(mcp): reserve parent capacity for timeout recovery
* fix(artifacts): contain ASAR cancellation before output consumption
* test(artifacts): hash ASAR cancellation fixture bytes
Node's CommonJS loader matches registered extensions case-sensitively, so
require("./data.JSON") and require("./addon.NODE") run as JavaScript.
Derive target_json_status and the native loads relation from the exact
loader suffix instead of the inventory's case-folded file kind.
Fixes#7623
inspect-apple-ips and inspect-pe-imports were the two commands in the
binary diagnostics group whose positional target was still a plain
string. An empty argument passed CLI validation, was resolved to the
working directory, and failed later as a non-file input, unlike their
siblings (inspect-elf-notes, inspect-pe-certificates and others) that
already reject it at validation.
Declare both targets with the shared nonempty, NUL-free local path
schema the rest of the file uses. Explicit "." is unchanged.
Fixes#7421
Local file commands in the core binary, native, managed and native-tool
CLI groups declared their positional target as a plain string. An empty
argument therefore reached path admission, where it resolved to the
working directory, as docs/cli.md says it never should.
Declare those targets with the shared nonempty, NUL-free local path
schema already used by analyze, so the CLI rejects them as a
VALIDATION_ERROR naming the field before any analysis runner is called.
Explicit "." is unchanged.
Fixes#7436Fixes#7404
Field, MethodDef and MemberRef signature issues reported the invalid operand's offset inside its blob, while local signature issues in the same coverage array used artifact file offsets. Translate both through one helper that adds the blob's artifact base.
Fixes#7385
* fix(pe): report exhausted certificate decoder allowances as resource limits
A PKCS#7 payload that exhausted the fixed 64 KiB decoded-text or 16,384-value ASN.1 allowance was refused as malformed input with advice to correct request fields. Keep the allowance and limit on the decoder failure and report it as a nonretryable resource_constraint with fixed-allowance recovery.
Fixes#7531
* test(pe): cover certificate allowances through MCP
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(cli): preserve literal Markdown table facts
* test(cli): retain capacity diagnostics through Markdown escaping
* fix(cli): keep intraword underscores readable in Markdown tables
Underscore runs between letters or digits cannot open or close CommonMark emphasis, so escaping them only adds noise to identifiers such as source_index and invalid_request in raw Markdown. Escape underscore runs only at word boundaries and restore the original diagnostic assertions.
* fix(flutter): honor ELF note alignment when reading build IDs
* test(flutter): key shared note ranges by effective alignment
Cover a program and section declaration that share one note range: differing effective alignments (8 and 4) must both be read, while declarations that both normalize to four bytes (1 and 4) still share one read. 24-byte build IDs pad identically at both alignments, so only the range key decides the read count.
RRFZ