fix(uuid): unbreak compliance ratchet and match google/uuid leniency - #196
Merged
sspaink merged 2 commits intoAug 12, 2026
Merged
Conversation
uuid.parse and uuid.rfc4122 are registered in BuiltinRegistry as of open-policy-agent#155, so no compliance case reports them missing anymore. The ratchet fails on entries that are no longer missing, which leaves ComplianceTest red on main: These builtins are listed in compliance/known-missing-builtins.txt but no compliance case reported them missing [...] [uuid.parse, uuid.rfc4122] The four upstream uuid fixtures (9 cases) pass once the lines are gone. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
uuid.parse rejected two input forms that OPA accepts, both verified with
opa eval against OPA 1.19.0 (the version pinned by the compliance test
generator):
uuid.parse("URN:UUID:000003e8-48b9-21ee-b200-325096b39f47") # defined
uuid.parse("(000003e8-48b9-21ee-b200-325096b39f47)") # defined
google/uuid compares the urn prefix with strings.EqualFold, so any
casing parses; normalize() used a case-sensitive startsWith.
For the 38-byte "Microsoft style" form, google/uuid only strips the
first byte and then examines the middle 36 — indexes 0 and 37 are never
checked, as its doc comment notes ("Only the middle 36 bytes are
examined in the latter case"). normalize() required literal braces,
making (uuid), Xuuid Y and {uuidX undefined here but defined upstream.
The upstream uuid fixtures do not cover either case, so both get unit
tests until the cases can be contributed to OPA and picked up by
regenerate.sh.
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
sspaink
added a commit
to sspaink/opa
that referenced
this pull request
Aug 12, 2026
The existing uuid cases cover the lowercase urn form and the braced
38-byte form, but not two adjacent behaviors that fall out of
google/uuid.Parse:
- the urn prefix is compared with strings.EqualFold, so URN:UUID: and
any other casing parse just as urn:uuid: does — RFC 8141 makes the
scheme and namespace identifier case-insensitive
- the 38-byte "Microsoft style" form strips the leading byte and then
examines only the middle 36, so the surrounding bytes need not be
braces ("Only the middle 36 bytes are examined in the latter case")
Both are easy for a reimplementation to get wrong by reaching for a
case-sensitive prefix check or requiring literal braces, and neither is
currently pinned by a case. Both diverged in the Java SDK
(open-policy-agent/java-opa-sdk#196) while passing the existing
fixtures. Expected values were taken from OPA v1.19.0; per-case
rationale is in the fixture comments.
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
sspaink
added a commit
to sspaink/opa
that referenced
this pull request
Aug 12, 2026
The existing uuid cases cover the lowercase urn form and the braced
38-byte form, but not two adjacent behaviors that fall out of
google/uuid.Parse:
- the urn prefix is compared with strings.EqualFold, so URN:UUID: and
any other casing parse just as urn:uuid: does — RFC 8141 makes the
scheme and namespace identifier case-insensitive
- the 38-byte "Microsoft style" form strips the leading byte and then
examines only the middle 36, so the surrounding bytes need not be
braces ("Only the middle 36 bytes are examined in the latter case")
Both are easy for a reimplementation to get wrong by reaching for a
case-sensitive prefix check or requiring literal braces, and neither is
currently pinned by a case. Both diverged in the Java SDK
(open-policy-agent/java-opa-sdk#196) while passing the existing
fixtures. Expected values were taken from OPA v1.19.0; per-case
rationale is in the fixture comments.
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
sspaink
added a commit
to sspaink/opa
that referenced
this pull request
Aug 12, 2026
The existing uuid cases cover the lowercase urn form and the braced
38-byte form, but not two adjacent behaviors that fall out of
google/uuid.Parse:
- the urn prefix is compared with strings.EqualFold, so URN:UUID: and
any other casing parse just as urn:uuid: does — RFC 8141 makes the
scheme and namespace identifier case-insensitive
- the 38-byte "Microsoft style" form strips the leading byte and then
examines only the middle 36, so the surrounding bytes need not be
braces ("Only the middle 36 bytes are examined in the latter case")
Both are easy for a reimplementation to get wrong by reaching for a
case-sensitive prefix check or requiring literal braces, and neither is
currently pinned by a case. Both diverged in the Java SDK
(open-policy-agent/java-opa-sdk#196) while passing the existing
fixtures. Expected values were taken from OPA v1.19.0; per-case
rationale is in the fixture comments.
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two follow-ups to #155. First,
uuid.parse/uuid.rfc4122are registered inBuiltinRegistrybut were left inknown-missing-builtins.txt, soComplianceTestcurrently fails onmainwith "listed ... but no compliance case reported them missing" — the first commit deletes the two lines.Second,
uuid.parsereturned undefined for two forms OPA accepts, both checked withopa evalagainst OPA 1.19.0 (the version pinned intools/generate-compliance-tests/go.mod):URN:UUID:...(google/uuid compares the prefix withstrings.EqualFold) and the 38-byte form without literal braces such as(...)orX...Y(google/uuid strips the leading byte and only examines the middle 36). The upstream fixtures cover neither, so both get unit tests here; I'm proposing the cases to OPA soregenerate.shpicks them up later.Two items from the review remain for follow-up:
getEvaluationCacheValuereusesctx.getNdCacheValues()(the decision-log reporting list) for same-key stability, andrfc4122callsgetArgpurely for type validation while discarding the result.