feat: scored identify + decode of unknown BLOBs (timeglyph-for-blobs) - #1
Merged
Conversation
Failing tests define the engine: scored best-first candidates, magic identification of bplist/gzip/zlib/snappy/plist/json against real tool-produced inputs, recursive base64->gzip->json unwrap, honest UUID scoring, and graceful degradation on adversarial input. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Implements the orchestration layer over plist/flate2/snap/base64/hex/ uuid/serde_json: magic detection (bplist/gzip/zlib/snappy/plist/json), structural heuristics (base64/hex/uuid/utf16/utf8), honest scored Confidence, and recursive wrapper unwrap with depth + decompressed-size caps (decompression-bomb / infinite-nest DoS guards). 23 tests green; clippy -D warnings and fmt clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
File/stdin/--string/--hex/--base64 input, human tree + --json output, --top trimming, pipeline-safe exit codes (0 identified / 2 unknown / 1 error). 5 CLI tests green; clippy + fmt clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Single target over the sole entry point; 300k local runs clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds real python3-produced bplist/xml-plist fixtures (provenance in tests/data/README.md), tests that exercise the plist paths and the sort tiebreak everywhere, and the cov:unreachable gate script. One defensive fallback arm is annotated; all other lib functions covered. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…tandard)
ci.yml (test matrix, MSRV 1.88 lib job, lean-build, coverage gate,
gitleaks, cargo-deny, freshness), fuzz.yml, docs.yml + mkdocs; deny.toml,
.gitleaks.toml, .pre-commit-config.yaml, renovate.json; README, SECURITY,
CHANGELOG, docs/{index,privacy,terms,validation}.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitHub licensee could not match the previous paraphrased license text, so the repo displayed 'Other' despite Cargo.toml declaring Apache-2.0. Replace with the canonical apache.org Apache-2.0 text so the license is reproduced verbatim (a condition of the license) and GitHub detects it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Local mkdocs build/gh-deploy emits site/; ephemeral build output (CI's docs.yml rebuilds it), so keep it out of the tree. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New fleet crate.
identify(&[u8]) -> Vec<Candidate>returns scored, cited candidates best-first; wrapper candidates nest aDecodedChainso a base64→gzip→JSON blob reports the full chain. Decoding is delegated to the mature crates (plist/base64/hex/uuid/flate2/snap/serde_json) — this crate only orchestrates identify → dispatch → score → recursively unwrap.#![forbid(unsafe_code)], panic-free, depth-capped recursion + size-capped decompression against bombs.Full local gate green (fmt/clippy/34 tests/deny/100% fn coverage/fuzz 300k no-crash). Validated tier-2 against independent producers (CPython plistlib/zlib, system gzip/base64/uuidgen). Honest MSRV 1.88 (set by plist→time, not our code).
Scoring heuristics flagged for review (all conservative/low-scored): base64 over-fires at Low on any len%4==0 charset text; zlib requires successful inflate (no magic); only framed snappy is detected; raw-16-byte inputs always carry a Uuid Low candidate; JSON claims only object/array roots.
🤖 Generated with Claude Code