parsanol 1.3.130-arm-linux → 1.3.132-arm-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '08291c7ebdfc64af963151769f7276a22723d98be2609c0299841b34bea18a67'
-  data.tar.gz: 3be47e65486f7e76ae124dc326713d7d7fb711295e423a85633e02917622cb1e
+  metadata.gz: 8a9a959842c1ec95a2e7d65f2e4571468d74006d3a6e0934c652c49d34c2d123
+  data.tar.gz: e341531eaff526a3ec332f5acff1dbe26b520c141e343a280ae3aa340f121698
 SHA512:
-  metadata.gz: 03b12bbe3c4750b36e2575f8e39909e4337082596a7641e3b479ee75bc902ad0d4a3cda0677d8bfb91708abbfa1a3e719392b4b7763fb00d5af5ec15018621be
-  data.tar.gz: d1f717ea3d3c7836d9e270cb099742262f944422a094ae73bf215904921981c1da69b3ece4cc217eb43942b8ea0a54714aa194908cf1c80a33c11f55ceb94249
+  metadata.gz: 8c5c65ac083e83de4891d1635ab046e09c34d783ef7863d01113c7ef41bbf15ac103df6c768525928366dec353daeb9789fdbbcb84d8040f6abf55dfc915dd04
+  data.tar.gz: c8832db22368e9b0715369bee7ddf9a46e19aeddb51217486f509300f84e533ae4e996cfe890eae9fad6a6782fa019ebe57e368daa10436dcefd17548ba41749

data/lib/parsanol/3.2/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/3.2/parsanol_native.so
-size: 39866820 bytes
-sha256: d427de1a20cb3ce4b7f87f7b9785e1b972e24f0715e17fe642141743d84aa537
+size: 40174108 bytes
+sha256: a4abd3f5e778228091e4116065ebb81d15adc599f3482bf9b622737742021ec4

data/lib/parsanol/3.3/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/3.3/parsanol_native.so
-size: 40052048 bytes
-sha256: ae5b75934aaa0b288ab140101dfa510f16d7590d15c27744ab5c40576b6c8c76
+size: 40359356 bytes
+sha256: fbdca2cc15d273d19be06530ec4fa0f3510de1b1279bd8afef9ff9dbf519accc

data/lib/parsanol/3.4/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/3.4/parsanol_native.so
-size: 40046192 bytes
-sha256: ef69925f79b48d090ed69227d6dca2a4cf8d7dc6e2ca1cfe1ad4028b43bb7ada
+size: 40353544 bytes
+sha256: e35eba05fd94a28eac6d1251f1be6cd2db12e9b18cad47a211d8b1106edfc743

data/lib/parsanol/4.0/parsanol_native.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/4.0/parsanol_native.so
-size: 40055908 bytes
-sha256: 4aa30d859f847ed62f581007ed01eaf3225df16066ffac565fff7014b8ee31aa
+size: 40363240 bytes
+sha256: 986c052f3c478ec717dbc61f81d11a1210428cf300d9e6c140b23ba68994fe66

data/lib/parsanol/native/libparsanol.so

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: data/lib/parsanol/native/libparsanol.so
-size: 36187320 bytes
-sha256: 254ef54622a09917e602bb0e443b7125fa3a35a7a89d4c51300df7ff26019f3a
+size: 36496788 bytes
+sha256: 2bf9b4db07fed268f82cee8074cf77bb08a302ceec53c8bd8f48bfdf00220ae4

data/lib/parsanol/parg/artifact.rb

@@ -15,13 +15,15 @@ module Parsanol
       attr_reader :envelope, :path, :tables_dir, :imports_dir
 
       def self.load(path, tables_dir: nil, imports_dir: nil)
-        envelope = JSON.parse(PARG.read_utf8(path))
+        text = PARG.read_utf8(path)
+        envelope = JSON.parse(text)
         new(envelope, path, tables_dir || File.dirname(path),
-            imports_dir: imports_dir)
+            imports_dir: imports_dir, raw_text: text)
       end
 
       def self.from_json(text, tables_dir: nil, imports_dir: nil)
-        new(JSON.parse(text), nil, tables_dir, imports_dir: imports_dir)
+        new(JSON.parse(text), nil, tables_dir, imports_dir: imports_dir,
+                                               raw_text: text)
       end
 
       SUPPORTED_SHAPE = "parsanol-tree/v2"
@@ -37,7 +39,7 @@ module Parsanol
         2 => 2, "2" => 2, "v2" => 2
       }.freeze
 
-      def initialize(envelope, path, tables_dir, imports_dir: nil)
+      def initialize(envelope, path, tables_dir, imports_dir: nil, raw_text: nil)
         unless envelope["shape"] == SUPPORTED_SHAPE
           raise ArtifactError,
                 "unsupported artifact shape #{envelope['shape'].inspect} " \
@@ -63,6 +65,7 @@ module Parsanol
         # sources when the pure-Ruby path recompiles the embedded source;
         # in-memory artifacts (path nil) pass the directory explicitly.
         @imports_dir = imports_dir
+        @raw_text = raw_text
         verify_checksum!
         @compiler = nil
       end
@@ -655,7 +658,16 @@ module Parsanol
         @compiled[rule] ||= compiler.atom_for(rule)
       end
 
+      # Two tiers. FAST: when the bake sealed the file, a zero-hole
+      # sha256 over the raw bytes proves byte integrity without parsing
+      # semantics — O(bytes), no canonicalization. DEEP: the canonical
+      # checksum (cross-engine content equality), which also covers
+      # artifacts baked before byte_checksum existed. A sealed artifact
+      # loaded with its raw text verifies BOTH; a bare envelope (direct
+      # construction) verifies canonical only.
       def verify_checksum!
+        verify_byte_checksum! if envelope["byte_checksum"]
+
         stored = envelope["checksum"]
         computed = Compiler.checksum(envelope)
         return if stored == computed
@@ -664,6 +676,26 @@ module Parsanol
               "artifact checksum mismatch: stored #{stored.inspect}, " \
               "computed #{computed.inspect}"
       end
+
+      # The bake computed the digest over the file bytes with the
+      # digest's own 64-hex region zeroed (Compiler.seal_json). Any
+      # flipped bit anywhere else in the file mismatches — corrupted
+      # distribution, wrong file, hand-edited payload: all rejected
+      # before any parse work.
+      def verify_byte_checksum!
+        stored = envelope["byte_checksum"]
+        return if stored.nil? || @raw_text.nil?
+
+        placeholder = Compiler::BYTE_CHECKSUM_PLACEHOLDER
+        zeroed = @raw_text.sub(stored.to_s, placeholder)
+        computed = "sha256:#{Digest::SHA256.hexdigest(zeroed)}"
+        return if stored == computed
+
+        raise ArtifactError,
+              "artifact byte checksum mismatch: stored #{stored.inspect}, " \
+              "computed #{computed.inspect} — the file bytes are not the " \
+              "sealed bake output"
+      end
     end
   end
 end

data/lib/parsanol/parg/cli.rb

@@ -18,7 +18,11 @@ module Parsanol
         usage: parsanol parg <command> <grammar> [arguments]
 
         commands:
-          compile <file.parg> [-o out.json]   compile to an artifact envelope
+          compile <file.parg> [-o out.json] [--bindings TARGET|all]
+                                            compile to an artifact envelope;
+                                            --bindings also writes one
+                                            checksummed per-target binding
+                                            artifact beside it (#432)
           test    <file.parg|artifact.json>   run the grammar's test section
           parse   <file> [--entry E] INPUT  parse one input; prints the tree
                                             and the bound captures
@@ -141,11 +145,33 @@ module Parsanol
         source = @argv.shift
         out = flag_value("-o") || default_artifact_name(source)
         envelope = compile_source(source).envelope
-        File.write(out, "#{JSON.generate(envelope)}\n", encoding: Encoding::UTF_8)
+        # Seal: the exact text written is the exact text the byte-level
+        # checksum covers (Compiler.seal_json includes the trailing
+        # newline).
+        File.write(out, Compiler.seal_json(envelope), encoding: Encoding::UTF_8)
         puts "#{out}  #{envelope['checksum']}  warnings=#{envelope['lint']['order_warnings'].size}"
+        bindings_targets.each do |target|
+          # The declared per-target binding artifacts (#432): one
+          # checksummed bindings payload per target, written beside the
+          # artifact. `--bindings all` expands to the full target set.
+          artifact = Artifact.from_json(JSON.generate(envelope))
+          path = out.sub(/\.json\z/i, ".bindings.#{target}.json")
+          File.write(path, "#{artifact.bindings_artifact_json(target)}\n", encoding: Encoding::UTF_8)
+          puts "#{path}  #{artifact.bindings_artifact(target).payload['checksum']}"
+        end
         0
       end
 
+      # Every --bindings flag value, `all` expanded to the target set.
+      # Empty when the flag is absent (compile emits no binding artifacts).
+      def bindings_targets
+        values = []
+        while (value = flag_value("--bindings"))
+          values.concat(value == "all" ? Bindings::Artifact::TARGETS.dup : [value])
+        end
+        values.uniq
+      end
+
       # Freshness (parsanol-ruby#209): verify an artifact was compiled
       # from the given source. The stale-shipped-artifact incident class
       # (an old artifact silently taking precedence over the corrected

data/lib/parsanol/parg/compiler.rb

@@ -25,19 +25,43 @@ module Parsanol
         new(document, tables_dir).compile
       end
 
-      # Canonical checksum over an envelope (everything except the checksum
-      # itself). Used both when building an artifact and when verifying one.
+      # Canonical checksum over an envelope (everything except the
+      # checksum itself and the byte-level checksum — the byte digest
+      # attests the FILE serialization, which is producer-specific and
+      # must never enter the cross-engine canonical payload). Used both
+      # when building an artifact and when verifying one.
       def self.checksum(envelope)
-        payload = envelope.except("checksum")
+        payload = envelope.except("checksum", "byte_checksum")
         "sha256:#{Digest::SHA256.hexdigest(JSON.generate(canonicalize(payload)))}"
       end
 
+      # The byte-level checksum's placeholder: a fixed-width zero region,
+      # so the sealed bytes and the verification bytes differ only inside
+      # that region (sha256 hex is 64 chars — same width).
+      BYTE_CHECKSUM_PLACEHOLDER = ("0" * 64).freeze
+      BYTE_CHECKSUM_TRAILING = "\n"
+
+      # Seal an envelope for writing: stamp the byte-level checksum over
+      # the exact file bytes (the final serialization with a trailing
+      # newline and the digest's own region zeroed) and return the exact
+      # text to write. No sidecar — the integrity travels inside the
+      # artifact. The canonical `checksum` is untouched: it attests
+      # content, `byte_checksum` attests bytes.
+      def self.seal_json(envelope)
+        sealed = envelope.merge("byte_checksum" => BYTE_CHECKSUM_PLACEHOLDER)
+        text = JSON.generate(sealed) + BYTE_CHECKSUM_TRAILING
+        digest = Digest::SHA256.hexdigest(text)
+        sealed["byte_checksum"] = "sha256:#{digest}"
+        JSON.generate(sealed) + BYTE_CHECKSUM_TRAILING
+      end
+
       # Producer metadata: the checksum pins the exact producer, but the
       # semantics hash (ruby#377) skips these fields so a re-bake by a
       # newer compiler — or a different Ruby patch stamping
       # unicode_tables — is byte-stable when the grammar's behavior is
       # unchanged. Mirrors the cross-engine parity view.
-      SEMANTICS_EXCLUDED = %w[checksum compiler_version unicode_tables semantics_hash].freeze
+      SEMANTICS_EXCLUDED = %w[checksum byte_checksum compiler_version
+                              unicode_tables semantics_hash validated].freeze
 
       def self.semantics_hash(envelope)
         payload = envelope.except(*SEMANTICS_EXCLUDED)
@@ -129,6 +153,18 @@ module Parsanol
         failures = self.class.self_test(envelope, tables_dir: @tables_dir)
         raise CompileError, failures.join("\n") unless failures.empty?
 
+        # The validation receipt: what this bake actually checked, inside
+        # the envelope the checksums cover. "valid/validated" is then an
+        # inspectable field of the artifact, not an out-of-band claim.
+        envelope["validated"] = {
+          "lint_errors" => 0, # compile raises on lint errors before this
+          "lint_warnings" => @envelope_warnings.size,
+          "tests_total" => @document.tests.size,
+          "tests_failures" => 0, # run_tests raises on failures before this
+          "self_test" => Native.available?,
+        }
+        envelope["checksum"] = Compiler.checksum(envelope)
+
         Result.new(@atom_cache, @warnings, envelope)
       end
 

data/lib/parsanol/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Parsanol
-  VERSION = "1.3.130"
+  VERSION = "1.3.132"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parsanol
 version: !ruby/object:Gem::Version
-  version: 1.3.130
+  version: 1.3.132
 platform: arm-linux
 authors:
 - Ribose Inc.