parsanol 1.3.130-aarch64-linux → 1.3.132-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 147fa1b4b09c7fbf0da0149a6d77dac14cda6bb6dda5c93cbdb1a91e01505346
-  data.tar.gz: 8264f6f37afe9dbba6e1b4c5c43164eb24dc18b0c3220c67ee1942bf46ce8c33
+  metadata.gz: 858f8defa63f9c570ba144672710e3d152dcf8c9e4e2433ca63085f2c6573b1e
+  data.tar.gz: 2c45e86e29e2a55f4ef6c312bfcb42d5766b7e7f343ee74ee903f080f47fa839
 SHA512:
-  metadata.gz: 4f4d24a7faf80254f9b927f7d16df15b4629e4c0f78ab6e41bf464dc20067b0b086978198717de66af954234db2d6340f84f496bc0fbde74518635d8a892a557
-  data.tar.gz: e8faf9507ee432b2c5c0941239ec5122acd4c5c547978cc43d5990a473fd11bc055081c21c0d4ad83abd17858bbfdae2c6452ae00c0d1fe6898261b37cb124c3
+  metadata.gz: 837d88e5055370b3929b7626f4045a95112f8745fed10a90cfe79b8fe6df6acfc5337bbaf9d80fe6f2431912f83e26cc5665b7f1dd6a8295661c1d13e8c1317c
+  data.tar.gz: 12d330e16733a67a038b2cb2750f3a514375b1bbf5dcd778f20fb8128f33dd7fcfc5d07cb4d38dfca8842d7d1ade199f688facf3d5089fef47e53cdfe4e4a7d5

data/lib/parsanol/3.2/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/3.2/parsanol_native.so
-size: 47067800 bytes
-sha256: 652002b1d06d654635fcde5365367d688d81bc55691b59799c92be2051165b09
+size: 47412264 bytes
+sha256: ad5843845e6d583178abc630acb3bf6ea77f7944beb00d3f4312dc19a0e12f7e

data/lib/parsanol/3.3/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/3.3/parsanol_native.so
-size: 47302944 bytes
-sha256: 6cc3f000e39baf60b108cd6eb37beace605a6f75434ac651f16c91d49441da36
+size: 47647304 bytes
+sha256: ae55584ad3bb49b78d5f2a2f496cf47bcf6bb89070484f98ff936d45de6a1ad7

data/lib/parsanol/3.4/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/3.4/parsanol_native.so
-size: 47298544 bytes
-sha256: 178a1d42ff09fa4eaf837f7af48cd7ff3ae06922a4005565f1c6d788a14ec312
+size: 47647080 bytes
+sha256: a0a07b8bb12f97e21c7e4056df1c4971ed51578080306b4a4c7961610374ba1b

data/lib/parsanol/4.0/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/4.0/parsanol_native.so
-size: 47308536 bytes
-sha256: d644e6e76268084ea3520dfa5630fcd892eb6d9dfd7e6d7209bd88c836baae35
+size: 47657088 bytes
+sha256: bc004ef9e5f6794a52c01ec04536c34d32a9a129c6ee2076c545efec1b1bae7d

data/lib/parsanol/native/libparsanol.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/native/libparsanol.so
-size: 42777792 bytes
-sha256: 8e7cd8e9943ae0c50bcf181aafd345d1f31bb21a0fba713ee332c8bf76de8a63
+size: 43125664 bytes
+sha256: 63ef8e072548f50461d5624438deb51e41bb60f0b0d1a57c5bb76695367a645d

data/lib/parsanol/parg/artifact.rb

@@ -15,13 +15,15 @@ module Parsanol
       attr_reader :envelope, :path, :tables_dir, :imports_dir
 
       def self.load(path, tables_dir: nil, imports_dir: nil)
-        envelope = JSON.parse(PARG.read_utf8(path))
+        text = PARG.read_utf8(path)
+        envelope = JSON.parse(text)
         new(envelope, path, tables_dir || File.dirname(path),
-            imports_dir: imports_dir)
+            imports_dir: imports_dir, raw_text: text)
       end
 
       def self.from_json(text, tables_dir: nil, imports_dir: nil)
-        new(JSON.parse(text), nil, tables_dir, imports_dir: imports_dir)
+        new(JSON.parse(text), nil, tables_dir, imports_dir: imports_dir,
+                                               raw_text: text)
       end
 
       SUPPORTED_SHAPE = "parsanol-tree/v2"
@@ -37,7 +39,7 @@ module Parsanol
         2 => 2, "2" => 2, "v2" => 2
       }.freeze
 
-      def initialize(envelope, path, tables_dir, imports_dir: nil)
+      def initialize(envelope, path, tables_dir, imports_dir: nil, raw_text: nil)
         unless envelope["shape"] == SUPPORTED_SHAPE
           raise ArtifactError,
                 "unsupported artifact shape #{envelope['shape'].inspect} " \
@@ -63,6 +65,7 @@ module Parsanol
         # sources when the pure-Ruby path recompiles the embedded source;
         # in-memory artifacts (path nil) pass the directory explicitly.
         @imports_dir = imports_dir
+        @raw_text = raw_text
         verify_checksum!
         @compiler = nil
       end
@@ -655,7 +658,16 @@ module Parsanol
         @compiled[rule] ||= compiler.atom_for(rule)
       end
 
+      # Two tiers. FAST: when the bake sealed the file, a zero-hole
+      # sha256 over the raw bytes proves byte integrity without parsing
+      # semantics — O(bytes), no canonicalization. DEEP: the canonical
+      # checksum (cross-engine content equality), which also covers
+      # artifacts baked before byte_checksum existed. A sealed artifact
+      # loaded with its raw text verifies BOTH; a bare envelope (direct
+      # construction) verifies canonical only.
       def verify_checksum!
+        verify_byte_checksum! if envelope["byte_checksum"]
+
         stored = envelope["checksum"]
         computed = Compiler.checksum(envelope)
         return if stored == computed
@@ -664,6 +676,26 @@ module Parsanol
               "artifact checksum mismatch: stored #{stored.inspect}, " \
               "computed #{computed.inspect}"
       end
+
+      # The bake computed the digest over the file bytes with the
+      # digest's own 64-hex region zeroed (Compiler.seal_json). Any
+      # flipped bit anywhere else in the file mismatches — corrupted
+      # distribution, wrong file, hand-edited payload: all rejected
+      # before any parse work.
+      def verify_byte_checksum!
+        stored = envelope["byte_checksum"]
+        return if stored.nil? || @raw_text.nil?
+
+        placeholder = Compiler::BYTE_CHECKSUM_PLACEHOLDER
+        zeroed = @raw_text.sub(stored.to_s, placeholder)
+        computed = "sha256:#{Digest::SHA256.hexdigest(zeroed)}"
+        return if stored == computed
+
+        raise ArtifactError,
+              "artifact byte checksum mismatch: stored #{stored.inspect}, " \
+              "computed #{computed.inspect} — the file bytes are not the " \
+              "sealed bake output"
+      end
     end
   end
 end

data/lib/parsanol/parg/cli.rb

@@ -18,7 +18,11 @@ module Parsanol
         usage: parsanol parg <command> <grammar> [arguments]
 
         commands:
-          compile <file.parg> [-o out.json]   compile to an artifact envelope
+          compile <file.parg> [-o out.json] [--bindings TARGET|all]
+                                            compile to an artifact envelope;
+                                            --bindings also writes one
+                                            checksummed per-target binding
+                                            artifact beside it (#432)
           test    <file.parg|artifact.json>   run the grammar's test section
           parse   <file> [--entry E] INPUT  parse one input; prints the tree
                                             and the bound captures
@@ -141,11 +145,33 @@ module Parsanol
         source = @argv.shift
         out = flag_value("-o") || default_artifact_name(source)
         envelope = compile_source(source).envelope
-        File.write(out, "#{JSON.generate(envelope)}\n", encoding: Encoding::UTF_8)
+        # Seal: the exact text written is the exact text the byte-level
+        # checksum covers (Compiler.seal_json includes the trailing
+        # newline).
+        File.write(out, Compiler.seal_json(envelope), encoding: Encoding::UTF_8)
         puts "#{out}  #{envelope['checksum']}  warnings=#{envelope['lint']['order_warnings'].size}"
+        bindings_targets.each do |target|
+          # The declared per-target binding artifacts (#432): one
+          # checksummed bindings payload per target, written beside the
+          # artifact. `--bindings all` expands to the full target set.
+          artifact = Artifact.from_json(JSON.generate(envelope))
+          path = out.sub(/\.json\z/i, ".bindings.#{target}.json")
+          File.write(path, "#{artifact.bindings_artifact_json(target)}\n", encoding: Encoding::UTF_8)
+          puts "#{path}  #{artifact.bindings_artifact(target).payload['checksum']}"
+        end
         0
       end
 
+      # Every --bindings flag value, `all` expanded to the target set.
+      # Empty when the flag is absent (compile emits no binding artifacts).
+      def bindings_targets
+        values = []
+        while (value = flag_value("--bindings"))
+          values.concat(value == "all" ? Bindings::Artifact::TARGETS.dup : [value])
+        end
+        values.uniq
+      end
+
       # Freshness (parsanol-ruby#209): verify an artifact was compiled
       # from the given source. The stale-shipped-artifact incident class
       # (an old artifact silently taking precedence over the corrected

data/lib/parsanol/parg/compiler.rb

@@ -25,19 +25,43 @@ module Parsanol
         new(document, tables_dir).compile
       end
 
-      # Canonical checksum over an envelope (everything except the checksum
-      # itself). Used both when building an artifact and when verifying one.
+      # Canonical checksum over an envelope (everything except the
+      # checksum itself and the byte-level checksum — the byte digest
+      # attests the FILE serialization, which is producer-specific and
+      # must never enter the cross-engine canonical payload). Used both
+      # when building an artifact and when verifying one.
       def self.checksum(envelope)
-        payload = envelope.except("checksum")
+        payload = envelope.except("checksum", "byte_checksum")
         "sha256:#{Digest::SHA256.hexdigest(JSON.generate(canonicalize(payload)))}"
       end
 
+      # The byte-level checksum's placeholder: a fixed-width zero region,
+      # so the sealed bytes and the verification bytes differ only inside
+      # that region (sha256 hex is 64 chars — same width).
+      BYTE_CHECKSUM_PLACEHOLDER = ("0" * 64).freeze
+      BYTE_CHECKSUM_TRAILING = "\n"
+
+      # Seal an envelope for writing: stamp the byte-level checksum over
+      # the exact file bytes (the final serialization with a trailing
+      # newline and the digest's own region zeroed) and return the exact
+      # text to write. No sidecar — the integrity travels inside the
+      # artifact. The canonical `checksum` is untouched: it attests
+      # content, `byte_checksum` attests bytes.
+      def self.seal_json(envelope)
+        sealed = envelope.merge("byte_checksum" => BYTE_CHECKSUM_PLACEHOLDER)
+        text = JSON.generate(sealed) + BYTE_CHECKSUM_TRAILING
+        digest = Digest::SHA256.hexdigest(text)
+        sealed["byte_checksum"] = "sha256:#{digest}"
+        JSON.generate(sealed) + BYTE_CHECKSUM_TRAILING
+      end
+
       # Producer metadata: the checksum pins the exact producer, but the
       # semantics hash (ruby#377) skips these fields so a re-bake by a
       # newer compiler — or a different Ruby patch stamping
       # unicode_tables — is byte-stable when the grammar's behavior is
       # unchanged. Mirrors the cross-engine parity view.
-      SEMANTICS_EXCLUDED = %w[checksum compiler_version unicode_tables semantics_hash].freeze
+      SEMANTICS_EXCLUDED = %w[checksum byte_checksum compiler_version
+                              unicode_tables semantics_hash validated].freeze
 
       def self.semantics_hash(envelope)
         payload = envelope.except(*SEMANTICS_EXCLUDED)
@@ -129,6 +153,18 @@ module Parsanol
         failures = self.class.self_test(envelope, tables_dir: @tables_dir)
         raise CompileError, failures.join("\n") unless failures.empty?
 
+        # The validation receipt: what this bake actually checked, inside
+        # the envelope the checksums cover. "valid/validated" is then an
+        # inspectable field of the artifact, not an out-of-band claim.
+        envelope["validated"] = {
+          "lint_errors" => 0, # compile raises on lint errors before this
+          "lint_warnings" => @envelope_warnings.size,
+          "tests_total" => @document.tests.size,
+          "tests_failures" => 0, # run_tests raises on failures before this
+          "self_test" => Native.available?,
+        }
+        envelope["checksum"] = Compiler.checksum(envelope)
+
         Result.new(@atom_cache, @warnings, envelope)
       end
 

data/lib/parsanol/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Parsanol
-  VERSION = "1.3.130"
+  VERSION = "1.3.132"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parsanol
 version: !ruby/object:Gem::Version
-  version: 1.3.130
+  version: 1.3.132
 platform: aarch64-linux
 authors:
 - Ribose Inc.