gabriel / musehub public
BREAKING task/canonical-hash-idioms #7 / 8
AI Agent gabriel · 152 days ago · Apr 25, 2026 · Diff

security: enforce canonical codec idioms across all tests

- Replace all 'sha256:' + hashlib.sha256(...).hexdigest() with blob_id() - Replace all key fingerprints with public_key_fingerprint() - request_signing.py body hash upgraded to sha256:-prefixed blob_id() - test_msign_request_signing: canonical message body hash tests updated - test_musehub_auth_challenge_db: fingerprint helper uses public_key_fingerprint (DB column is String(71) — bare 64-char hex was wrong) - test_static_assets: cache version computation uses split_id(blob_id()) - test_domains: compute_manifest_hash assertion uses blob_id() - test_gc_object_refs: _oid helper produces prefixed IDs - test_load_readiness: object IDs now blob_id-prefixed - test_object_store_canonical: _sha256_oid helper uses blob_id() - factories._sha: produces blob_id-prefixed commit IDs

sha256:f1982a9b5d265c9a83c3e1e4fefee7a2abbbad6b528c9093b16cd0e1512872a6 sha
sha256:6446ba8458fa34b51f554362dbfe68004b9dfef00a29378b22ac15d638fd368b parent
+26 ~37 −25 symbols
sha256:ed98443e39ca80a1411a81932f88cecd66a733a477700fcda6d8d18bd278a4b8 snapshot
+26
symbols added
~37
symbols modified
−25
symbols removed
0
dead code introduced
Semantic Changes 88 symbols
~ musehub/auth/request_signing.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L35–35
+ blob_id import import blob_id L45–45
~ build_canonical_message
~ tests/bench_push.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L23–23
+ blob_id import import blob_id L39–39
~ _sha256_oid
~ tests/factories.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L23–23
+ blob_id import import blob_id L26–26
~ _sha
~ tests/test_api_performance.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L16–16
+ blob_id import import blob_id L20–20
~ test_local_backend_stream_yields_all_content
~ tests/test_background_jobs.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L12–12
+ blob_id import import blob_id L20–20
~ test_push_enqueues_intel_jobs
~ tests/test_delta_compressed_base_regression.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L26–26
+ blob_id import import blob_id L34–34
~ _sha256_oid
~ tests/test_domains.py .py 1 symbol added, 1 symbol removed, 2 symbols modified
− hashlib import import hashlib L19–19
+ blob_id import import blob_id L27–27
~ TestUnitComputeManifestHash
~ test_matches_manual_sha256
~ tests/test_encoding_roundtrip.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L22–22
+ blob_id import import blob_id L31–31
~ _sha256_oid
~ tests/test_gc_object_refs.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L18–18
+ blob_id import import blob_id L26–26
~ _oid
~ tests/test_load_readiness.py .py 2 symbols modified
~ TestWriteHeavyReadiness
~ test_concurrent_push_preflight_does_not_deadlock
~ tests/test_msign_request_signing.py .py 1 symbol added, 1 symbol removed, 3 symbols modified
− hashlib import import hashlib L23–23
+ blob_id import import blob_id L27–27
~ TestBuildCanonicalMessage
~ test_empty_body_produces_sha256_of_empty
~ test_sixth_line_is_sha256_hex_of_body
~ tests/test_musehub_auth_challenge_db.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L17–17
+ public_key_fingerprint import import public_key_fingerprint L19–19
~ _fp
~ tests/test_musehub_auth_crypto.py .py 1 symbol added, 1 symbol removed, 2 symbols modified
− hashlib import import hashlib L16–16
+ public_key_fingerprint import import public_key_fingerprint L19–19
~ TestKeyFingerprint
~ test_is_sha256_prefixed_hex
~ tests/test_object_integrity.py .py 1 symbol added, 1 symbol removed, 2 symbols modified
− hashlib import import hashlib L9–9
+ blob_id import import blob_id L21–21
~ _sha256_id
~ _sha256_object_id
~ tests/test_object_store.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L14–14
+ blob_id import import blob_id L22–22
~ _sha256_id
~ tests/test_object_store_canonical.py .py 1 symbol added, 1 symbol removed, 5 symbols modified
− hashlib import import hashlib L27–27
+ blob_id import import blob_id L36–36
~ TestSecurity
~ test_content_hash_mismatch_rejected_on_push
~ test_raw_hex_oid_in_push_rejected
~ _push
~ _sha256_oid
~ tests/test_quota_via_refs.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L17–17
+ blob_id import import blob_id L27–27
~ _oid
~ tests/test_snapshot_entries.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L19–19
+ blob_id import import blob_id L21–21
~ _uid
~ tests/test_static_assets.py .py 2 symbols added, 1 symbol removed, 2 symbols modified
− hashlib import import hashlib L12–12
+ blob_id import import blob_id L16–16
+ split_id import import split_id L16–16
~ TestStaticVersion
~ test_static_version_is_8_hex_chars_when_assets_exist
~ tests/test_wire_framing.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L16–16
+ blob_id import import blob_id L21–21
~ _sha256_oid
~ tests/test_wire_multibatch_push.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L40–40
+ blob_id import import blob_id L42–42
~ _sha256_oid
~ tests/test_wire_oc_server.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L14–14
+ blob_id import import blob_id L20–20
~ _sha256_oid
~ tests/test_wire_push_plain.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L14–14
+ blob_id import import blob_id L24–24
~ _sha256_oid
~ tests/test_wire_push_stream.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L21–21
+ blob_id import import blob_id L32–32
~ _sha256_oid
~ tests/test_wire_snapshot_delta.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L14–14
+ blob_id import import blob_id L16–16
~ _sha256_manifest
~ tests/test_wire_streaming_push.py .py 1 symbol added, 1 symbol removed, 1 symbol modified
− hashlib import import hashlib L17–17
+ blob_id import import blob_id L27–27
~ _sha256_oid
Older fix: replace all inline bare-hash constructions with canonical c… sha256:6446ba8458fa34b51f554362dbfe68004b9dfef00a29378b22ac15d638fd368b All commits Newer style: replace string concatenation with f-string interpolation … sha256:5e86e423b6b99897e7a20834af66e95bc9f20f0114a4f7ebf41bcfee28b07348

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:f1982a9b5d265c9a83c3e1e4fefee7a2abbbad6b528c9093b16cd0e1512872a6 --body "your comment"