mirror of
https://github.com/block/buzz.git
synced 2026-10-27 20:41:57 +00:00
7881447c19
Hash new audit entries from a TLV buffer built with one-byte field tags, big-endian u64 byte lengths, and raw values. Absent optional fields are omitted; present empty values retain their tag and zero length. This prevents bytes from moving between fields without restricting object IDs or inferring boundaries from field contents. Store an explicit `hash_version`. Migration 0048 labels existing rows as version 1, and new writers use version 2. Historical hashes are unchanged and mixed-version chains verify. The legacy encoding retains its original ambiguity; TLV protects new entries. Apply the migration before deploying the updated writers and verifiers. Tests cover both boundary collisions, absent versus empty fields, stable digests, unknown versions, mixed-version chains, and stored-row tampering. All 16 audit and 128 database unit tests passed. The six PostgreSQL audit tests passed against both migrated and fresh schemas, and a populated-row migration check preserved the historical hash. Full `just ci` passed. Related audit fixes: #4216 and #4249; issue #4173. Signed-off-by: Jordan Mecom <jm@squareup.com>
5 lines
191 B
SQL
5 lines
191 B
SQL
-- Preserve existing hashes. New writers explicitly select the TLV encoding.
|
|
ALTER TABLE audit_log
|
|
ADD COLUMN hash_version SMALLINT NOT NULL DEFAULT 1
|
|
CHECK (hash_version IN (1, 2));
|