Problem
verify_assertion() compares the peer-supplied assertion version with:
if data.get("version") != ASSERTION_VERSION:where ASSERTION_VERSION = 1.
In Python, True == 1, so a JSON assertion carrying:
is accepted as version 1 instead of being refused as an invalid version primitive.
The companion content-marking specification defines the assertion with "version": 1 and says an unknown version is rejected rather than parsed best-effort. The current verifier therefore admits a boolean value as the known version because of host-language equality semantics.
Reproduction
Starting from a valid assertion produced by build_assertion(), replace only:
assertion["data"]["version"] = True
verify_assertion(assertion, record_bytes) succeeds on current main.
The existing version regression covers version = 2, but not the Python bool/int boundary.
Proposed change
Establish the version primitive before accepting version 1, explicitly excluding bool.
A minimal regression set should hold:
1 -> accepted;true -> refused;false -> refused;"1" -> refused;null -> refused;- another integer such as
2 -> refused.
This issue deliberately does not make a claim about floating-point JSON numbers; the defect is the unambiguous Python bool/int equivalence.
Scope
Consumer-side validation only. No wire-format, schema, cryptographic, downgrade, or C2PA change is proposed.
AI-assistance disclosure: ChatGPT assisted with source triage, adversarial-case design, and drafting. altrudev reviewed the bounded claim and remains responsible for the contribution.
Problem
verify_assertion()compares the peer-supplied assertion version with:where
ASSERTION_VERSION = 1.In Python,
True == 1, so a JSON assertion carrying:{"version": true}is accepted as version 1 instead of being refused as an invalid version primitive.
The companion content-marking specification defines the assertion with
"version": 1and says an unknown version is rejected rather than parsed best-effort. The current verifier therefore admits a boolean value as the known version because of host-language equality semantics.Reproduction
Starting from a valid assertion produced by
build_assertion(), replace only:verify_assertion(assertion, record_bytes)succeeds on currentmain.The existing version regression covers
version = 2, but not the Pythonbool/intboundary.Proposed change
Establish the version primitive before accepting version 1, explicitly excluding
bool.A minimal regression set should hold:
1-> accepted;true-> refused;false-> refused;"1"-> refused;null-> refused;2-> refused.This issue deliberately does not make a claim about floating-point JSON numbers; the defect is the unambiguous Python
bool/intequivalence.Scope
Consumer-side validation only. No wire-format, schema, cryptographic, downgrade, or C2PA change is proposed.
AI-assistance disclosure: ChatGPT assisted with source triage, adversarial-case design, and drafting.
altrudevreviewed the bounded claim and remains responsible for the contribution.