Preserve exact evidence bytes in private publication records

internal/publish/record_test.go

@@ -8,11 +8,87 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"sort"
 	"strings"
 	"testing"
 )
 
+func TestRecordsRoundTripNonUTF8Evidence(t *testing.T) {
+	repo := recordRepo(t)
+	raw := "path-\xff"
+	evidence := Evidence{RepositoryDir: raw, ModuleDir: raw, ModulePath: raw, Version: raw, Tag: raw, CandidateCommit: raw, TagObject: raw, Endpoint: raw, Remote: raw, RecordedAt: raw}
+	path, err := SaveEvidence(t.Context(), repo, t.TempDir(), evidence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	loaded, err := LoadEvidence(path)
+	if err != nil || loaded != evidence {
+		t.Fatalf("lossy evidence: %#v, %v", loaded, err)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var envelope recordEnvelope
+	if err := json.Unmarshal(data, &envelope); err != nil || envelope.FormatVersion != recordByteFormatVersion {
+		t.Fatalf("byte record envelope: %#v, %v", envelope, err)
+	}
+	// Unknown fields remain ignorable; known byte fields retain real codec errors.
+	for _, test := range []struct {
+		field     string
+		wantError bool
+	}{{"endpoint", true}, {"future_field", false}} {
+		envelope.EvidenceBytes = json.RawMessage(`{"` + test.field + `":"not base64!"}`)
+		data, err := json.Marshal(envelope)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(path, data, 0600); err != nil {
+			t.Fatal(err)
+		}
+		_, err = LoadEvidence(path)
+		if (err != nil) != test.wantError {
+			t.Fatalf("byte field %s error=%v", test.field, err)
+		}
+	}
+}
+
+func TestRecordLoadedObservationKeepsNonUTF8EndpointIdentity(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("raw pathname bytes are a POSIX behavior")
+	}
+	repo := recordRepo(t)
+	base := t.TempDir()
+	original := filepath.Join(base, "remote-\xff.git")
+	decoy := filepath.Join(base, "remote-\uFFFD.git")
+	for _, remote := range []string{original, decoy} {
+		recordGit(t, repo, "init", "--bare", remote)
+	}
+	recordGit(t, repo, "tag", "-a", "v1.2.3", "-m", "Release")
+	recordGit(t, repo, "push", decoy, "refs/tags/v1.2.3")
+	evidence := Evidence{RepositoryDir: repo, ModuleDir: repo, Endpoint: original, Tag: "v1.2.3", TagObject: strings.TrimSpace(recordGit(t, repo, "rev-parse", "v1.2.3")), CandidateCommit: strings.TrimSpace(recordGit(t, repo, "rev-parse", "HEAD"))}
+	path, err := SaveEvidence(t.Context(), repo, "", evidence)
+	if err != nil {
+		t.Fatal(err)
+	}
+	loaded, err := LoadEvidence(path)
+	if err != nil || loaded.Endpoint != original {
+		t.Fatalf("endpoint changed: %q, %v", loaded.Endpoint, err)
+	}
+	for _, selected := range []Evidence{evidence, loaded} {
+		observed, err := Reconcile(t.Context(), selected)
+		if err != nil || observed.State != NotPublished {
+			t.Fatalf("original endpoint observation = %#v, %v", observed, err)
+		}
+	}
+	loaded.Endpoint = decoy
+	observed, err := Reconcile(t.Context(), loaded)
+	if err != nil || observed.State != Published {
+		t.Fatalf("decoy does not distinguish identity: %#v, %v", observed, err)
+	}
+}
+
 func recordGit(t *testing.T, dir string, args ...string) string {
 	t.Helper()
 	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
@@ -47,7 +123,7 @@ func TestLoadEvidenceAcceptsPartialAndRejectsMalformedRecords(t *testing.T) {
 	if err != nil || got != (Evidence{}) {
 		t.Fatalf("partial record = %#v, %v", got, err)
 	}
-	for name, data := range map[string]string{"bad-json": "{", "unsupported": `{"format_version":2,"evidence":{}}`, "type": `{"format_version":1,"evidence":{"tag":false}}`, "trailing": `{"format_version":1,"evidence":{}} {}`} {
+	for name, data := range map[string]string{"bad-json": "{", "unsupported": `{"format_version":3,"evidence":{}}`, "type": `{"format_version":1,"evidence":{"tag":false}}`, "trailing": `{"format_version":1,"evidence":{}} {}`} {
 		t.Run(name, func(t *testing.T) {
 			path := filepath.Join(dir, name)
 			if err := os.WriteFile(path, []byte(data), 0600); err != nil {