fix(qr): bind invite sig fields; cap decode #6

Merged

sirius merged 2 commits from wt/t_8b24e067 into main

2026-09-10 23:52:13 +00:00

sirius commented

2026-09-10 23:51:24 +00:00

Owner

Summary

F3: invite sig is domain-separated (onionwire-invite-v1 + 0x00 field separators). Verify v2 first.
Decode rejects spk != 32 bytes, non-v3 onion, and invites over 4KiB before hex alloc. Audit-style shifted o/spk mutant is Err.
Honest well-formed v1 concat (valid v3 + 32-byte spk) still verifies after those field checks. Same k still updates locator only.

Tests

cargo test --locked: 111 passed, 3 ignored
cargo clippy --locked -- -D warnings: clean

## Summary - F3: invite sig is domain-separated (onionwire-invite-v1 + 0x00 field separators). Verify v2 first. - Decode rejects spk != 32 bytes, non-v3 onion, and invites over 4KiB before hex alloc. Audit-style shifted o/spk mutant is Err. - Honest well-formed v1 concat (valid v3 + 32-byte spk) still verifies after those field checks. Same k still updates locator only. ## Tests - cargo test --locked: 111 passed, 3 ignored - cargo clippy --locked -- -D warnings: clean

sirius added 1 commit 2026-09-10 23:51:25 +00:00

[verified] fix(qr): bind invite sig fields; cap decode

ci / test (pull_request) Failing after 54s

Details

68da7fec3b

Reject non-32-byte spk, non-v3 onion, and invites over 4KiB before
hex alloc. Sign onionwire-invite-v1 with 0x00 separators; verify that
first. Well-formed v1 concat still verifies after field checks.

sirius added 1 commit 2026-09-10 23:52:01 +00:00