security(release): reject malformed UTF-8 in retained SBOM evidence

[seonghobae]

Problem

Protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 reads retained CycloneDX SBOM evidence before release semantics. Ordinary Node UTF-8 string decoding can replace malformed byte sequences with U+FFFD, allowing byte-invalid retained evidence to become a different Unicode JSON document before validation.

This is an exact retained-byte integrity boundary. Parser hardening must not be confused with release publication, deployment, licensing, or acquisition acceptance.

RCA

• First failing boundary: exact SBOM bytes -> Unicode JSON semantics in scripts/release-evidence.mjs.
• Immediate cause: non-fatal UTF-8 decoding through readFileSync(..., "utf8").
• Root cause: structural CycloneDX validation existed without an explicit valid-byte/text boundary.
• Systemic risk: corrupted retained evidence can normalize into a different valid document while appearing semantically acceptable.

Active test-first repair

PR #113 (fix(release): reject malformed UTF-8 SBOM evidence) is the current direct-main repair.

• protected/live base: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• RED head: 42cb0c53d94dd21b73f5de7d07468bdeec1fd1f2;
• current exact GREEN head: 13849868812c7dc52cd3b973d89fa261ea5e9011;
• PR state: Ready, mergeable, direct main.

RED injects a malformed UTF-8 byte into an otherwise structurally valid CycloneDX JSON document and requires failure plus absence of a release-evidence manifest. GREEN reads exact SBOM bytes and decodes them with TextDecoder("utf-8", { fatal: true }) before JSON.parse; SBOM digest generation remains bound to the exact retained bytes.

Exact current proof

For unchanged #113 head 13849868812c7dc52cd3b973d89fa261ea5e9011:

• application ci 31439391439: terminal success;
• reviewer-ci 31439391449: terminal success;
• eligible central Security Scan 31439391436: terminal success;
• formal reviews: 0;
• inline review threads: 0;
• the CodeRabbit exact-head attempt was rate-limited and is non-passing/non-approval evidence.

Acceptance

Repository-owned implementation on #113 current exact head

• Malformed UTF-8 anywhere in retained SBOM bytes fails closed before JSON/CycloneDX semantics are trusted.
• Valid UTF-8 CycloneDX evidence remains accepted.
• The SHA-256 recorded for the SBOM remains the digest of the exact retained bytes.
• Malformed-byte failure does not produce a successful release-evidence manifest.
• Focused RED -> GREEN plus exact-head application CI, reviewer-ci, eligible central Security Scan and current review/thread validation are complete.
• No outbound license, release publication, deployment or acquisition-readiness claim is created by parser hardening.

Remaining protected integration / release acceptance

• Obtain live chore(governance): protect main and enforce release checks #27 governance and qualifying independent non-author formal approval required by chore(operations): provision and activate hourly maintainer App #29 where applicable; mergeability/check success/model output are not substitutes.
• Merge only an unchanged exact head after every applicable gate remains satisfied.
• Re-run malformed-byte and valid-SBOM contracts from protected main after integration.
• Keep immutable publication, deployment, exact-release licensing/NOTICE/IP, production KPI and acquisition evidence as separate fail-closed facts.
• Treat independently confirmed descriptor/path identity or duplicate-decoded-key defects as separate bounded repairs rather than silently bundling them.

Related: #5, #27, #29, #68, #69, #113

[seonghobae]

Protected-main acceptance is now complete on the surviving current lineage. PR #199 was rebuilt/restacked onto the then-live protected base without transferring predecessor evidence; exact head aa4e55ffea9b46f5f8b8fe89a428e42aff8b77e7 passed application ci 31560731360, reviewer-ci 31560731345, and protected-base eligible central Security Scan 31560731382, with zero current formal reviews/threads and exact 100% configured owned-production statement/branch/function/line thresholds exercised by release:verify. The unchanged head was merged under the actual live ruleset. Protected main is now c67ec43c4ffecc0560d5952350b700e5bdb67953; current scripts/release-evidence.mjs decodes exact retained SBOM bytes with fatal UTF-8 before JSON semantics and keeps SHA-256 bound to the retained file bytes. Post-merge protected-main ci 31560917640 and reviewer-ci 31560917639 both completed success, and the dynamic code-quality runs on the same protected head also completed success. This closes the repository-owned malformed-UTF-8 SBOM boundary only; immutable publication, deployment, owner/legal/IP, production KPI, revenue and acquisition evidence remain separate fail-closed facts. Historical PR #113 is not mutated here because its source branch independently moved during this invocation; no historical check/review evidence is transferred.