The Silent Field Loss: Why a Green CI Pipeline is Lying to You

Description and use

Problem: A CI pipeline can pass schema validation yet silently drop optional fields, causing semantic loss. Solution: employ negative control tests and an independent oracle to ensure all fields survive parsing.

Problem

Schema‑valid CI pipelines can silently drop optional fields, causing semantic loss in cryptographic data formats.

Outcome

Negative control testing and independent oracles uncovered silent field loss and line‑ending normalization bugs, leading to a more reliable CI pipeline that validates both structure and semantics.

Workflow

• 1. Construct a CBOM document with optional fields.
• 2. Parse the document with the Python library.
• 3. Emit the document back to JSON.
• 4. Assert that all original fields survive the round‑trip; fail if any are missing.
• 5. Cross‑verify cryptographic outputs (public keys, ciphertexts, shared secrets) against an independent reference implementation.
• 6. For deployment, fetch the public URL and compare raw bytes to the git object to detect line‑ending normalization issues.

Evidence

Your CI is green, your schema validation passes, but the data might be silently disappearing.

Source

It passed. But when we printed the output, it looked like this: ... algorithmFamily was gone.

Source

We wrote a script that explicitly constructs a document with these fields, parses it, and asserts their survival.

Source