The Silent Field Loss: Why a Green CI Pipeline is Lying to You

Описание и применение

Проблема: CI‑пайплайн, проходящий проверку схемы, может скрыто удалять опциональные поля в криптографических форматах. Решение: негативное контрольное тестирование и независимый оракл гарантируют семантическую целостность.

Задача

Schema‑valid CI pipelines can silently drop optional fields, causing semantic loss in cryptographic data formats.

Результат

Negative control testing and independent oracle integration uncovered silent field loss, leading to a robust CI workflow that guarantees semantic integrity of cryptographic data.

Рабочий процесс

• 1. Construct a CBOM document with all optional fields.
• 2. Parse the document with the Python library.
• 3. Emit the document back to JSON.
• 4. Assert that all original fields survive the round‑trip; fail if any are missing.
• 5. Cross‑verify cryptographic outputs (public keys, ciphertexts, shared secrets) against an independent reference implementation.

Доказательства

Your CI is green, your schema validation passes, but the data might be silently disappearing.

Источник

It passed. But when we printed the output, it looked like this: ... algorithmFamily was gone.

Источник

To catch this "silent field loss," traditional unit tests are useless... You need Negative Control Testing and an Independent Oracle.

Источник