[Bug] The seal claim promises detection of any later change; it covers the .md only #581

New issue

Closed

opened 2026-07-22 16:16:33 +00:00 by brenno · 1 comment

brenno commented

2026-07-22 16:16:33 +00:00

Owner

Found in the pre-publication legal review.

The claim — README.md:28: a report can be "finalised and sealed (SHA-512 over the canonicalised content, detecting any later change)".

What the code does: lib/services/seal_codec.dart:22-25 notes that the hash may be taken over the bytes of the .md rather than over the output of OciDeck own serialiser. Sidecars fall outside it entirely: .ink.json, data/*.csv, the evidence images, and <name>.seal.json itself are not hashed. The project design document already has the honest wording — docs/design/PENTEST_MIAUW.md:396-397: "The guarantee is tamper-evidence, not impossibility."

Why this must be fixed before publication: this is the claim a client actually relies on in a dispute about a penetration-test report. "Detecting any later change" is a guarantee-shaped statement about an audit property, and it is false in a way that matters: swap a chart CSV or an evidence image and the seal stays green. EUPL-1.2 art. 7 disclaims warranty, but a specific factual product characteristic in the README cuts straight through that, and under the revised product liability directive ((EU) 2024/2853, transposition due end of 2026) such a claim counts as a product characteristic rather than advertising.

Proposal: replace the parenthesis with what is true and still strong: "SHA-512 over the bytes of the stored .md, so a recipient can re-check it with sha512sum; the seal covers the .md, not the sidecars and evidence files." That is what the in-app text already says and what the design document already establishes.

Found in the pre-publication legal review. **The claim** — `README.md:28`: a report can be "finalised and sealed (**SHA-512 over the canonicalised content, detecting any later change**)". **What the code does:** `lib/services/seal_codec.dart:22-25` notes that the hash may be taken over the *bytes of the `.md`* rather than over the output of OciDeck own serialiser. Sidecars fall outside it entirely: `.ink.json`, `data/*.csv`, the evidence images, and `<name>.seal.json` itself are not hashed. The project design document already has the honest wording — `docs/design/PENTEST_MIAUW.md:396-397`: "The guarantee is **tamper-*evidence***, not impossibility." **Why this must be fixed before publication:** this is the claim a client actually relies on in a dispute about a penetration-test report. "Detecting any later change" is a guarantee-shaped statement about an audit property, and it is false in a way that matters: swap a chart CSV or an evidence image and the seal stays green. EUPL-1.2 art. 7 disclaims warranty, but a specific factual product characteristic in the README cuts straight through that, and under the revised product liability directive ((EU) 2024/2853, transposition due end of 2026) such a claim counts as a product characteristic rather than advertising. **Proposal:** replace the parenthesis with what is true and still strong: "SHA-512 over the bytes of the stored `.md`, so a recipient can re-check it with `sha512sum`; the seal covers the `.md`, not the sidecars and evidence files." That is what the in-app text already says and what the design document already establishes.

brenno added the

bug

security

docs

labels

2026-07-22 16:16:33 +00:00

brenno referenced this issue

2026-07-22 17:14:10 +00:00

docs: de publicatieklaar-tros — 26 docs-issues in zeven commits #656

brenno added the

in-progress

label

2026-07-22 17:23:56 +00:00

brenno commented

2026-07-22 17:36:11 +00:00

Author

Owner

Stand na #656 (gemerged), geverifieerd op main — deels opgelost, blijft open.

De gevaarlijke zin is weg: de README zegt niet langer "detecting any later change", maar alleen nog "sealing" in de MIAUW-regel. Daarmee is de garantievormige bewering uit de etalage.

Wat er nog niet staat is de andere helft van dit issue: nergens wordt gezegd wát het zegel dekt. docs/USER_GUIDE.md:2782 zegt "its content is protected by a SHA-512 hash" en laat in het midden dat .ink.json, data/*.csv, de bewijsafbeeldingen en <name>.seal.json zelf erbuiten vallen. Een ontvanger die een bewijsafbeelding vervangt, houdt een groen zegel.

Voorstel blijft: één zin die zegt dat het zegel over de bytes van de .md gaat en dat de sidecars er niet in zitten — na te rekenen met sha512sum.

Stand na `#656` (gemerged), geverifieerd op `main` — **deels opgelost, blijft open**. De gevaarlijke zin is weg: de README zegt niet langer "detecting any later change", maar alleen nog "sealing" in de MIAUW-regel. Daarmee is de garantievormige bewering uit de etalage. Wat er nog niet staat is de andere helft van dit issue: nergens wordt gezegd wát het zegel dekt. `docs/USER_GUIDE.md:2782` zegt "its content is protected by a SHA-512 hash" en laat in het midden dat `.ink.json`, `data/*.csv`, de bewijsafbeeldingen en `<name>.seal.json` zelf erbuiten vallen. Een ontvanger die een bewijsafbeelding vervangt, houdt een groen zegel. Voorstel blijft: één zin die zegt dat het zegel over de bytes van de `.md` gaat en dat de sidecars er niet in zitten — na te rekenen met `sha512sum`.

brenno removed the

in-progress

label

2026-07-22 17:36:12 +00:00

brenno referenced this issue from a commit

2026-07-22 18:28:44 +00:00

docs+ui: zeg wat er standaard uit staat, en wat het zegel dekt

brenno referenced this issue from a pull request that will close it,

2026-07-22 18:28:46 +00:00

docs+ui: zeg wat er standaard uit staat, en wat het zegel dekt (#584, #581) #668

brenno closed this issue

2026-07-22 18:28:48 +00:00