PDFFence 1.18 adds rule to flag stale PDF signature byte-range coverage

·1 views

PDFFence 1.18.0, a PDF static-analysis tool, introduces an opt-in rule called PFP010 that flags cases where a PDF's signature byte-range coverage does not extend to the current end of file. The update complements the existing PFP009 rule, which detects regressions in signature coverage across document revisions. A new benchmark scenario demonstrates a case where a baseline PDF already has a stale byte-range boundary, and an appended revision leaves aggregate coverage counts at zero, making PFP010 the sole triggered policy. The release passed 235 tests and scored all 155 benchmark pairs, with both packages building reproducibly under Python 3.12 and 3.13. PDFFence explicitly does not validate cryptographic signatures, certificates, or trust chains, and only reports fixed aggregate counts and static findings.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Minimal 3-Node Raft Consensus Cluster to Explain Core Protocol

A developer published a tutorial on DEV Community demonstrating how to implement a minimal three-node Raft consensus cluster within a single process, without sockets, threads, or real-time dependencies. Nodes communicate through a simulated network, with a virtual clock managing delivery latency and election timeouts. The implementation covers the four core Raft mechanisms: leader election, log replication, commitment, and leader failover. Raft ensures distributed consensus by designating a strong leader per term, which coordinates client writes and replicates log entries to follower nodes. The article intentionally omits production concerns like persistent storage and membership changes to keep the core protocol visible and easier to understand.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Go's typed-nil trap silently crashed a rate limiter when Redis was absent

A developer building Grounded LLM, an open-source document assistant platform, discovered a subtle Go bug during CI smoke tests for the v0.4 enterprise-hardening release. The rate limiter was designed to fall back to an in-memory backend when Redis was unavailable, but instead crashed with a hard panic on the first incoming request. The root cause was Go's typed-nil interface behavior: a nil *redis.Client pointer boxed into a redis.Cmdable interface evaluated as non-nil, tricking the limiter into enabling Redis mode despite no live client existing. The fix involved two defensive layers — returning a true nil interface at the source and adding an explicit typed-nil guard inside the WithRedis constructor — along with a regression test to prevent recurrence. The bug was caught in CI before reaching production and is now merged into the v0.4.0 release.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Launches Agent Sandbox to Safely Run AI-Generated Code on Kubernetes

Google Cloud has released Agent Sandbox, a managed GKE feature that provides isolated, stateful Linux containers for executing untrusted, LLM-generated code. Each sandbox runs as a single-replica Kubernetes workload with a stable hostname, persistent storage, kernel-level isolation, and a default deny-all network policy. The system is built on Kubernetes custom resource definitions, including primitives for sandbox instances, reusable templates, and warm pools that allow pre-started sandboxes to be assigned in milliseconds. An open-source controller under the kubernetes-sigs/agent-sandbox project lets teams run the same setup on their own clusters without relying on Google's managed offering. The feature addresses a growing security concern for platform engineers as AI agents are increasingly tasked with running shell commands, installing packages, and interacting with live infrastructure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer ports cron-parser from TypeScript to Go, uncovers silent date-handling bugs

A developer spent a weekend porting the popular cron-parser library from TypeScript to Go, running the original unmodified test suite against the new implementation. Using a differential testing harness, they discovered 41,088 divergences caused by subtle differences in how JavaScript's Luxon library and Go's time package handle date arithmetic and DST transitions. Key discrepancies included asymmetric month/year clamping versus overflow behavior and opposite DST gap resolution directions, the latter of which could silently shift results to the wrong calendar day. Four tests in the original suite were found to be passing vacuously — a spy asserting a method was never called trivially passes when the method does not exist in the ported code. The developer resolved all divergences and added instrumented logging to ensure the passing tests were genuinely meaningful rather than silent false positives.

0 comments Read more at DEV Community