The Silent Field Loss: Why a Green CI Pipeline is Lying to You

说明与用途

问题：CI流水线可能通过结构验证，但会悄悄丢失可选字段，导致语义丢失。解决方案：使用负控制测试和独立的参考实现来确保所有字段被保留。

问题

Schema‑valid CI pipelines can silently drop optional fields, causing semantic loss in cryptographic data formats.

结果

Negative control testing and independent oracles uncovered silent field loss and line‑ending normalization bugs, leading to a more reliable CI pipeline that validates both structure and semantics.

工作流

• 1. Construct a CBOM document with optional fields.
• 2. Parse the document with the Python library.
• 3. Emit the document back to JSON.
• 4. Assert that all original fields survive the round‑trip; fail if any are missing.
• 5. Cross‑verify cryptographic outputs (public keys, ciphertexts, shared secrets) against an independent reference implementation.
• 6. For deployment, fetch the public URL and compare raw bytes to the git object to detect line‑ending normalization issues.

证据

Your CI is green, your schema validation passes, but the data might be silently disappearing.

来源

It passed. But when we printed the output, it looked like this: ... algorithmFamily was gone.

来源

We wrote a script that explicitly constructs a document with these fields, parses it, and asserts their survival.

来源