Skip to content

docs: D5, what the module does with a caller-given host and base_path, and where target data should come from #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sinkog merged 1 commit into from
Nov 8, 2026
Merged

docs: D5, what the module does with a caller-given host and base_path, and where target data should come from #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion MANIFEST.sha256
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,6 @@
5432506f15d65fa59572362a70db4bc403c13b163ec961ecb2951d7f98d093d0 module/go.mod
546e7c533da4b86b8817ee426865df0d11e24d2aa1580647634345f452a5017e module/canonical_json_test.go
57980b8a84a13ffad62b7295e3095bd635f8894716665d0654dfb54eebbf10e5 docs/contracts/en/host-expectations.md
5b7f1f228e76f1240526022991728bbe1834c4c06b19ed5f52a15441e54dd6ee docs/design/README.md
5c650f84f688d4d965721df74779228bb6fdfa47d5c08c46e8274e6d97b212c8 module/testdata/vcn-v1/lifecycle-map.json
5ca6da66b9de8a04ca71f1c18ba2026ad02b8c1c70c700a432058da267e6b27d module/correspondence/vcn.json
5d51889fc8cd00c4c0bf1462b01be8c4d6754e2a4e59dd8e7f0599c610c64472 tools/vault-sign-agent.sh
Expand Down Expand Up @@ -110,6 +109,7 @@
794a6e83b11358f4f2105408d7798a3495fa992d09d469823d0148233e6df57e module/relay_integration_test.go
79f7c4ad204e39c79b7b55a0ee925a603250bb49610366a98e3210e1b925abd3 module/testdata/vcn-v1/cases/malformed-cidr/expected/observed.oci.json
7b2748a353c7aad1822022fbbb4a6271c54ef84a0fe5f3535f43850306857756 docs/design/measurements/destroy-invoke/README.md
7b465f60f85afd0ff9b2e98cba72461a7fb7aa3a3bf46954ffd5e2461f71ea94 docs/design/measurements/target-and-path/probe_test.go.txt
7b84214b85a3fd95e9153528df1fa1522ff026df1f561752d95c715250301ca6 tools/vault-sign-agent.md
7df714ce12b9abfb18357c4fc25e67b8f23e6557b72ee1ea4c2a4a5d4a596c43 docs/contracts/hu/host-expectations.md
7e18dd94212c07eb66f6db357067b71e870dc64d43336f9c1db3c08b30adf0f4 module/testdata/vcn-v1/cases/not-found/expected/observed.registry.json
Expand All @@ -129,6 +129,7 @@
8a269de9b6799fbda2837466293f020125b5376b4e0794eb25d8d4146af8aa0b docs/design/specs/relay-sign-send-interface.md
8c607fe4c6cb87f10a73accd46657733fffaf3c0d98c1197a48ffacb7d2c9803 module/testdata/vcn-v1/cases/desired-absent/expected/observed.registry.json
8c607fe4c6cb87f10a73accd46657733fffaf3c0d98c1197a48ffacb7d2c9803 module/testdata/vcn-v1/cases/field-absent/expected/observed.registry.json
8c9322cefff799c7068b28361644ff705988c081ff0978558aba0e047c0a862b docs/design/measurements/target-and-path/README.md
8c956255f18ea7baa83eec246e38e9138b9e29284972a2fa95084a70ea97d6a9 capability-manifest.schema.yaml
8db6dccfdd2342641ad77532d9f66b305f74920ecc116371e81d8a36c873c7fb tools/oci-extract/policy.go
8e2542ec21d36fd70c95f3f80573839906d137478edca225b81342f8cbda16e9 tests/test_ci_workflow_order.py
Expand All @@ -140,6 +141,7 @@
97b1851090675543e10f2d61ec390cf54d218b1bd0985b4f8195c6aa0ddef677 module/testdata/plan_digest_vectors.json
97f3f81e90d839c74efbe7ad2e1732b08ac0612a38499d6ef5dedcc637c64eb6 module/testdata/vcn-v1/cases/malformed-cidr/oci/response.json
9824bb348604556c7f55452fcc9e396c203f51311736e1c501f53ba4fdc127aa module/module_loadtest_test.go
985f45c885b583cc522db0a6570aea8baf9db816c9cf3409af7e60d3c204d6e6 docs/design/specs/target-origin-and-path-safety.md
9b18a2109d250d26d57d3cec5ed9c67bd803d34e9592ab98fb1826a5dc457a8f module/cicflow_mock_test.go
9b6f006a0e21f7baaad8509b3323e4c7e5bc4d16ab8cc165a70af855f78da460 module/testdata/canonical_json_vectors.json
9ba2ca374fd1900e82a2b6a9c27233e1603dce89b1908592b2a6cc93313be84c docs/hu/wasm-module-authoring.md
Expand Down Expand Up @@ -169,6 +171,7 @@ b73da39348121a3ae5bf42915a4ab3c35653b7c9fb5a4c575a9ce0d89da66c7a docs/en/wasm-m
b8107f8b819135d4ba3d56804ecca545c24bde54a381f5ddde7ac19815253734 docs/design/forms-integration-direction.md
b8e7c23cfe46a0daf7d3441b15657e9d4b35c4bf50f9421c2841dfbf19cacc82 docs/en/architecture.yaml
b9325f58a95216b240f3715a773e34fe8cdfa4d5fe48a5e7b32002a40be5cc2e tests/test_tools/test_finalize_release.py
b96d9bec819c23a253271f3f26ab999e27179cbf6381a4403f090a04bc9195f2 docs/design/README.md
bb8a1743ab9f77a309bd851b4a1660f6f2420900455a5a0dfb83f4e6905968ff module/abi_manifest_test.go
bbe93c718d90a03de5aab2999031c7097bd63a8e40ec14589c8dbe4364a4ec52 renovate.json
bdea227cb29b579b2daaa7fa398102adc096ff9073c78bd9ec1f0dde44b89824 docs/design/relay-requirements.md
Expand All @@ -180,6 +183,7 @@ c55c74bb201c91330aa8bda11dd256fe35f84b3a3a0e24a1cebe3e487bd60135 requirements.i
c637082ac035d4dda23ff27a31dfd7bd9a62437db24b53d48d585897fa1874a7 module/testdata/vcn-v1/not-planned.json
c6919cec77cbf13916932f91cdc9b9d32d9290282c5d87244af7adc1a30d441a module/go.sum
c83bb77196b26e0f656d38b38736a488ff2aa316d995908bf9abade63fccdd67 tools/wasm_fresh_guest_test.sh
c9518b3b8d5cf39095234f9d18feef5d8ea9fd22c6d129c77e9714838bba5b02 docs/design/measurements/target-and-path/output.txt
ca7e4a9412ff28a5ca3e3fd9c759a62126564d82e8892b12b6efa1cbf11d5810 tools/oci-extract/client.go
cb1301d5e401e05e2c14042cb1af909dc2bc819a636b5b4e1533f4c87ed48831 docs/design/specs/approval-and-execution-state.md
cb147348de6aadbcef95a82efb66d8e5252d1c82f34aba14c716747dea57d10f module/testdata/vcn-v1/cases/malformed-cidr/expected/evidence.claims.json
Expand Down
4 changes: 4 additions & 0 deletions docs/design/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,10 @@ namespace it opens. Written 2026-07-18 from the design session recorded in
computed over.
- [specs/plan-digest.md](specs/plan-digest.md) — `plan_digest`, `target_digest`,
`execution_digest` and the gate `execute` applies before it signs anything.
- [specs/target-origin-and-path-safety.md](specs/target-origin-and-path-safety.md) — D5: a
measurement of what the module does with a caller-given `host` and `base_path`, and a
proposal (concept) for where target data should come from; probes and output in
[measurements/target-and-path/](measurements/target-and-path/README.md).
- [specs/destroy-invoke-binding.md](specs/destroy-invoke-binding.md) — a measurement of what
`destroy` and `invoke` do today, the properties it implies, and a binding contract proposal
(concept); the probes and their output are in
Expand Down
47 changes: 47 additions & 0 deletions docs/design/measurements/target-and-path/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
# Target data and path building: measurement of the current behaviour

The probe and its output behind section 1 of
[`../../specs/target-origin-and-path-safety.md`](../../specs/target-origin-and-path-safety.md). It observes
what the module builds from a caller-given `host` and `base_path`, and what the CIC-Relay's
egress rule, as read in its source, makes of that. Kept unchanged so the tables can be checked.

## Environment of the recorded run

| | |
|---|---|
| Module commit | `2ac19ecade7131514a3103f20ab0d38cccf41521` (`devel`), taken with `git archive` into an empty directory, no working-tree residue |
| Go | go1.25.0 linux/amd64 (the repo's builder image `cic-module-oracle-cloud-builder:latest`, id `sha256:b5a3b64b391e6d4a1254b41dfa59f78025a603cfccdaacf902c408967047debf`) |
| Host | Linux 7.0.0-43-generic |
| Provider, Relay | neither is involved. The host seam is the module's own test mock (`cicFlowMock`): `sign` returns a fixed signature, `actuate` answers 200 |
| The Relay's rule | CIC-Relay at commit `55a899f`, **read, not run**: `cmd/relay/cic_flow_manifest.go` (`egressPolicy.allows` :73, `hostGlobMatch` :89, `portAllowed` :114, `pathAllowed` :126) and `cmd/relay/cic_flow_host_funcs.go` (`actuate`: `url.Parse` :153, the egress check on `u.Hostname()`, the port and `u.Path` :161). The probe contains a **transcription** of those rules (`relayHostGlob`, `relayPort`, `relayView`) and applies it to the URL string the module sent. It is not the Relay's code and the Relay's real behaviour was not measured |
| The module's manifest | `project.yaml` `capability_manifest.egress`: one rule, host `*.oraclecloud.com`, methods GET, POST, PUT, DELETE, PATCH, no ports (so 443 only), no paths (so any path) |

## Files

- `probe_test.go.txt` - `TestZZD5Host`, `TestZZD5BasePath`, `TestZZD5SamePathEverywhere`. A backslash in
a probe input is written `"\x5c"`, so no tool can rewrite it.
- `output.txt` - the output of the recorded run, verbatim. For each case: the URL the module handed to
`actuate`; the `(request-target)` and `host` lines of the string the module asked to have signed
(`ociCanonical`); and what the transcribed Relay rule makes of the URL (`hostname`, `port`, `path`,
`rawquery`, `fragment`, `user`, `egress`).

The files end in `.txt` so that they are not compiled into the module.

## Rerun

In a scratch copy of the commit above, not in the repository:

```
cp probe_test.go.txt <scratch>/module/zz_d5_probe_test.go
cd <scratch>/module
go test -count=1 -run 'TestZZD5' -v .
```

It uses helpers of the module's test package (`cicFlowMock`, `decodeResult`, `observeRequest`,
`destroyRequest`, `invokeRequest`, `pollRequest`, `m4aForOp`, `ociCanonical`, `opPath`).

## Limits

The module against a mock, and a transcription of a rule. Not measured: the real Relay, what OCI
does with any of these URLs, what a provider or a proxy does with dot segments or an encoded dot
segment, and what the Go HTTP client sends for a URL that carries a fragment.
Loading
Loading