FA-9891 / Packaging / Open access
Installed distribution record validation: Tampered file digests pass validation · case 01
Tampered file digests pass validation.
ROOT CAUSE
The implementation substitutes False for manifest[k][0] != installed[k][0], so tampered file digests pass validation.
VERIFIED REPAIR
Compare content digests.
Unsuccessful approach: The attempted repair substitutes manifest[k][0] == installed[k][0]. Fixture 4 still yields {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': []} instead of {'missing': [], 'extra': [], 'digest': ['a'], 'size': [], 'executable': []}.
Case contract
Report missing files, unexpected files, digest mismatches, size mismatches, and forbidden executables independently. Metadata is a digest-size-executable tuple.
Why this case matters
An offline model of installed distribution record validation, suitable for testing build and release tooling without external services.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(manifest, installed, executable_allowed):
common = set(manifest) & set(installed)
return {'missing': sorted(set(manifest)-set(installed)), 'extra': sorted(set(installed)-set(manifest)), 'digest': sorted(k for k in common if False), 'size': sorted(k for k in common if manifest[k][1] != installed[k][1]), 'executable': sorted(k for k in installed if installed[k][2] and k not in executable_allowed)}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve({}, {}, []), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': []})
check('fixture 2', solve({'a': ('x', 1, False)}, {}, []), {'missing': ['a'], 'extra': [], 'digest': [], 'size': [], 'executable': []})
check('fixture 3', solve({}, {'a': ('x', 1, False)}, []), {'missing': [], 'extra': ['a'], 'digest': [], 'size': [], 'executable': []})
check('fixture 4', solve({'a': ('x', 1, False)}, {'a': ('y', 1, False)}, []), {'missing': [], 'extra': [], 'digest': ['a'], 'size': [], 'executable': []})
check('fixture 5', solve({'a': ('x', 1, False)}, {'a': ('x', 2, False)}, []), {'missing': [], 'extra': [], 'digest': [], 'size': ['a'], 'executable': []})
check('fixture 6', solve({'a': ('x', 1, False)}, {'a': ('x', 1, True)}, []), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': ['a']})
check('fixture 7', solve({'a': ('x', 1, False)}, {'a': ('x', 1, True)}, ['a']), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': []})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Passed |
| fixture 2 | {'digest': [], 'executable': [], 'extra': [], 'missing': ['a'], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': ['a'], 'size': []} | Passed |
| fixture 3 | {'digest': [], 'executable': [], 'extra': ['a'], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': ['a'], 'missing': [], 'size': []} | Passed |
| fixture 4 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': ['a'], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Failed |
| fixture 5 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': ['a']} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': ['a']} | Passed |
| fixture 6 | {'digest': [], 'executable': ['a'], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': ['a'], 'extra': [], 'missing': [], 'size': []} | Passed |
| fixture 7 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Passed |
SHA-256 / 6c0d93b99db3b98ff836eb72dcd7cd2e2ed1e3bec5203ed0406f1dcd97e0d22a
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(manifest, installed, executable_allowed):
common = set(manifest) & set(installed)
return {'missing': sorted(set(manifest)-set(installed)), 'extra': sorted(set(installed)-set(manifest)), 'digest': sorted(k for k in common if manifest[k][0] == installed[k][0]), 'size': sorted(k for k in common if manifest[k][1] != installed[k][1]), 'executable': sorted(k for k in installed if installed[k][2] and k not in executable_allowed)}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve({}, {}, []), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': []})
check('fixture 2', solve({'a': ('x', 1, False)}, {}, []), {'missing': ['a'], 'extra': [], 'digest': [], 'size': [], 'executable': []})
check('fixture 3', solve({}, {'a': ('x', 1, False)}, []), {'missing': [], 'extra': ['a'], 'digest': [], 'size': [], 'executable': []})
check('fixture 4', solve({'a': ('x', 1, False)}, {'a': ('y', 1, False)}, []), {'missing': [], 'extra': [], 'digest': ['a'], 'size': [], 'executable': []})
check('fixture 5', solve({'a': ('x', 1, False)}, {'a': ('x', 2, False)}, []), {'missing': [], 'extra': [], 'digest': [], 'size': ['a'], 'executable': []})
check('fixture 6', solve({'a': ('x', 1, False)}, {'a': ('x', 1, True)}, []), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': ['a']})
check('fixture 7', solve({'a': ('x', 1, False)}, {'a': ('x', 1, True)}, ['a']), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': []})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Passed |
| fixture 2 | {'digest': [], 'executable': [], 'extra': [], 'missing': ['a'], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': ['a'], 'size': []} | Passed |
| fixture 3 | {'digest': [], 'executable': [], 'extra': ['a'], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': ['a'], 'missing': [], 'size': []} | Passed |
| fixture 4 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': ['a'], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Failed |
| fixture 5 | {'digest': ['a'], 'executable': [], 'extra': [], 'missing': [], 'size': ['a']} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': ['a']} | Failed |
| fixture 6 | {'digest': ['a'], 'executable': ['a'], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': ['a'], 'extra': [], 'missing': [], 'size': []} | Failed |
| fixture 7 | {'digest': ['a'], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Failed |
SHA-256 / 9a02938083ee0b7ca10a0d7e13e75c87e180f7dacad064290a23adb46a943257
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(manifest, installed, executable_allowed):
common = set(manifest) & set(installed)
return {'missing': sorted(set(manifest)-set(installed)), 'extra': sorted(set(installed)-set(manifest)), 'digest': sorted(k for k in common if manifest[k][0] != installed[k][0]), 'size': sorted(k for k in common if manifest[k][1] != installed[k][1]), 'executable': sorted(k for k in installed if installed[k][2] and k not in executable_allowed)}
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve({}, {}, []), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': []})
check('fixture 2', solve({'a': ('x', 1, False)}, {}, []), {'missing': ['a'], 'extra': [], 'digest': [], 'size': [], 'executable': []})
check('fixture 3', solve({}, {'a': ('x', 1, False)}, []), {'missing': [], 'extra': ['a'], 'digest': [], 'size': [], 'executable': []})
check('fixture 4', solve({'a': ('x', 1, False)}, {'a': ('y', 1, False)}, []), {'missing': [], 'extra': [], 'digest': ['a'], 'size': [], 'executable': []})
check('fixture 5', solve({'a': ('x', 1, False)}, {'a': ('x', 2, False)}, []), {'missing': [], 'extra': [], 'digest': [], 'size': ['a'], 'executable': []})
check('fixture 6', solve({'a': ('x', 1, False)}, {'a': ('x', 1, True)}, []), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': ['a']})
check('fixture 7', solve({'a': ('x', 1, False)}, {'a': ('x', 1, True)}, ['a']), {'missing': [], 'extra': [], 'digest': [], 'size': [], 'executable': []})
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Passed |
| fixture 2 | {'digest': [], 'executable': [], 'extra': [], 'missing': ['a'], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': ['a'], 'size': []} | Passed |
| fixture 3 | {'digest': [], 'executable': [], 'extra': ['a'], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': ['a'], 'missing': [], 'size': []} | Passed |
| fixture 4 | {'digest': ['a'], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': ['a'], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Passed |
| fixture 5 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': ['a']} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': ['a']} | Passed |
| fixture 6 | {'digest': [], 'executable': ['a'], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': ['a'], 'extra': [], 'missing': [], 'size': []} | Passed |
| fixture 7 | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | {'digest': [], 'executable': [], 'extra': [], 'missing': [], 'size': []} | Passed |
SHA-256 / 3baecf1f95f0ed8ef045deb2cc03208cc7a70c75a6fe65ab3fb4643313465104
Verification & scope
This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:38:34.010798+00:00.
Case digest / 6030ec595f8ec0ef3517cdc4878bd5125745203510ffe89a69811915c0ec0555