gabriel / muse public
BREAKING task/museignore-tls #17 / 19
AI Agent gabriel · 149 days ago · Apr 25, 2026 · Diff

security: enforce canonical codec idioms across all tests and source

- Replace all 'sha256:' + hashlib.sha256(...).hexdigest() with blob_id() - Replace all public key fingerprints with public_key_fingerprint() - MSign canonical message body hash upgraded to sha256:-prefixed blob_id() for algorithm agility (not permanently bound to SHA-256) - ast_parser._sha256/_sha256_bytes: blob_id() for content addressing - signer_key_id upgraded from 16-char truncated hex to full sha256:<64-hex> fingerprint (birthday attack resistance: 256-bit vs 64-bit) - test_core_transport: canonical message tests updated for new body hash format - test_core_msign: EMPTY_BODY_HASH and body hash tests updated - test_integrity_I9_sigkill: write_object now receives prefixed oid - test_mist_plugin: SnapshotManifest digest now blob_id-prefixed - test_code_migrate: v1 commit ID helper uses blob_id

sha256:dae82dd7b83a257cca663e50bccc9ea207e6329abc3a558e79fc7bab45ddc551 sha
sha256:9eddee9295ec4f1652bc213e5e9b343eec54a159b3b379f0ae2d119685adb3d8 parent
+5 ~18 −4 symbols
sha256:a55b01ccc6568fe903e6bdc82350aae871fe88c71eac1775c1d3ddc38168be10 snapshot
+5
symbols added
~18
symbols modified
−4
symbols removed
0
dead code introduced
Semantic Changes 27 symbols
~ muse/core/msign.py .py 1 symbol added, 1 symbol removed, 2 symbols modified
− hashlib import import hashlib L58–58
+ blob_id import import blob_id L63–63
~ EMPTY_BODY_HASH
~ canonical_message
~ muse/plugins/code/ast_parser.py .py 1 symbol added, 1 symbol removed, 2 symbols modified
− hashlib import import hashlib L85–85
+ blob_id import import blob_id L81–81
~ _sha256
~ _sha256_bytes
~ tests/test_code_migrate.py .py 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L24–24
~ _v1_commit_id
~ tests/test_code_plugin.py .py 1 symbol modified
~ _sha256_bytes
~ tests/test_core_msign.py .py 1 symbol added, 5 symbols modified
+ blob_id import import blob_id L44–44
~ TestCanonicalMessage
~ test_body_hash_covers_raw_bytes_not_repr
~ test_empty_body_uses_empty_sha256
~ test_format
~ test_six_newline_separated_fields
~ tests/test_core_transport.py .py 1 symbol added, 5 symbols modified
+ blob_id import import blob_id L15–15
~ TestBuildMsignHeader
~ test_none_body_treated_as_empty_bytes
~ test_query_string_included_in_canonical
~ test_signature_is_verifiable
~ MsgpackDict
~ tests/test_integrity_I9_sigkill.py .py 1 symbol modified
~ _write_objects_worker
~ tests/test_mist_plugin.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L24–24
+ blob_id import import blob_id L29–29
~ snap_with_one
Older fix: coordination.py split_id instead of hardcoded [7:] prefix strip sha256:9eddee9295ec4f1652bc213e5e9b343eec54a159b3b379f0ae2d119685adb3d8 All commits Newer refactor: replace hardcoded algo strings with DEFAULT_HASH_ALGO … sha256:72a605e96d8251ae8c84108f8b1c91b82bd7dc5e2f8933a9e577d8c76b141c3d

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:dae82dd7b83a257cca663e50bccc9ea207e6329abc3a558e79fc7bab45ddc551 --body "your comment"