4.3 KiB
P15-062 Stage0 Decision
Status: STOP. B26 is STOP-NO-SOURCE; no production source, B26 case, or
B26 fixture is authorized.
The decision is bound to DUT BASE
205a90465edb64e83ba44aaacac9bedad4cbe905, FreeBSD source HEAD
106727738dcfb6c001b46f25363b91cece970085, and exact upstream erofs-utils
commits for v1.4, v1.7, and v1.8.6. The authoritative gate evidence and final
script/input hashes are recorded below and in the G04 evidence commit.
The later B26 terminal review is recorded at
planning/pre15/evidence/20260817T-B26-terminal-review/VERDICT.md.
It retains STOP_NO_SOURCE / NOT_TESTED and adds secondary
TERMINAL_REVIEWED_NO_SOURCE. It found the historical zero-tail shape to be
reproducible, but did not establish that trailing zeros are format-mandated or
that current FreeBSD rejects them.
Authoritative Run
The gate ran from /work/erofs-freebsd-pre as:
timeout -k 10 240 repo-pre-15/tests/pre15/gates/P15-062.sh \
--base 205a90465edb64e83ba44aaacac9bedad4cbe905 \
--output planning/pre15/evidence/20260815T062257Z-G04-P15-062/gate-output
It returned the gate-defined STOP exit status 1. Evidence is rooted at
planning/pre15/evidence/20260815T062257Z-G04-P15-062/. The authoritative
script SHA-256 is
6af503f1612eb42410f91a54fdc37481bae86a4419232c9de48c08bfa7ecee5d and
the input SHA-256 is
390202738ac006aba2514d27d3b0a19a0123a009601a26cac3b560a3dff388e5.
The result SHA-256 is
597466203edcaee6d163651a6d6a05e49dff24f39201234911f9753b29eebbe0.
Decision Rule
G04 permits P15-062 only if every normative and historical full LZ4 input uses
the same exact-consumption rule. The B26 review found that the old fsck
acceptance path uses LZ4_decompress_safe_partial() for legacy/no-0padding
images, so that acceptance does not prove full physical consumption or format
legality. The format sources contain no stored compressed-stream length or
general trailing-zero rule. The current FreeBSD decoder accepts an all-zero
remainder and rejects nonzero remainder bytes; no implementation defect was
demonstrated.
Reproducible Corpus
The gate builds three upstream mkfs generations from exact commits in an owned
temporary directory. Each version twice generates the same fixed-time,
fixed-UUID, root-owned, xattr-free legacy LZ4 image from the same deterministic
1 MiB file. Matching fsck.erofs --extract accepts each image. The image,
source, build tree, and binaries remain temporary and are not committed.
The independent parser reconstructs the complete file from two physical
pclusters. The final extent has m_plen=4096, but its raw LZ4 stream reaches
9,670 decoded bytes after consuming 48 bytes; the remaining 4,048 bytes are
zero. This shape is byte-reproducible in v1.4, v1.7, and v1.8.6. The current
FreeBSD decoder accepts the whole input and liblz4 accepts the 48-byte exact
stream but rejects the block-sized input. The zero-tail shape is therefore a
historical tool-compatible candidate, not a proven format-legal fixture.
Partial and Corruption Controls
A separate v1.8.6 -Ededupe image contains two real noncompact
Z_EROFS_LI_PARTIAL_REF records that share an LZ4 pcluster. The independent
parser, liblz4 partial API, and frozen DUT callback agree on the 4,096- and
5,594-byte prefixes. Corruption beginning after the 4,096-byte request remains
undetected by that partial read but causes the same fixture's full decode to
return positive EINTEGRITY (97), as required by G04. Truncation and nonzero
tail controls also return 97; all output guards remain unchanged.
Production zdata.c ownership anchors show that metadata/physical input is
released after every decoder return, failed decoded output is freed, and only
successful output is published. The decoder itself allocates and owns no
buffers. The gate's owned build/image directory is removed, and it does not
start QEMU or touch protected PID 26318, port 9222, or the shared base image.
Consequence
P15-062 remains STOP for Pre15 because B26 has no authorized production source,
case, or fixture. src/decompressor_lz4.c,
tests/pre15/cases/B26-lz4-input.sh, and tests/pre15/fixtures/B26-* remain
unchanged or absent as applicable. B26 acceptance D, exact-ABI build, TC167
QEMU, and the full feature suite are not run because no implementation error
was demonstrated. The secondary B26 status is
TERMINAL_REVIEWED_NO_SOURCE.