The Silent Field Loss: Why a Green CI Pipeline is Lying to You

Описание и применение

Проблема: CI‑пайплайн может успешно валидировать схему, но при этом терять опциональные поля, что приводит к потере семантики. Решение: использовать негативный контроль и независимый оракл для проверки сохранения всех полей.

Задача

Schema‑valid CI pipelines can silently drop optional fields, causing semantic loss in cryptographic data formats.

Результат

Negative control testing and independent oracles uncovered silent field loss and line‑ending normalization bugs, leading to a more reliable CI pipeline that validates both structure and semantics.

Рабочий процесс

• 1. Construct a CBOM document with optional fields.
• 2. Parse the document with the Python library.
• 3. Emit the document back to JSON.
• 4. Assert that all original fields survive the round‑trip; fail if any are missing.
• 5. Cross‑verify cryptographic outputs (public keys, ciphertexts, shared secrets) against an independent reference implementation.
• 6. For deployment, fetch the public URL and compare raw bytes to the git object to detect line‑ending normalization issues.

Доказательства

Your CI is green, your schema validation passes, but the data might be silently disappearing.

Источник

It passed. But when we printed the output, it looked like this: ... algorithmFamily was gone.

Источник

We wrote a script that explicitly constructs a document with these fields, parses it, and asserts their survival.

Источник