README.md
In zucbor: Deterministic and Secure CBOR Encoding and Decoding

Conformance fixtures

Third-party CBOR test data, used by test-conformance.R (roadmap Stage 6). Every file here is generated by tools/update-fixtures from a pinned upstream source; do not edit them by hand. tools/run-conformance regenerates them into a temporary directory and fails if they differ from what is committed. The tests read only these files and never use the network.

| File | Source | Pinned at | Licence | |---|---|---|---| | qcbor-not-well-formed.txt | QCBOR test/not_well_formed_cbor.h: 122 not-well-formed items | commit 65fd7cb4 | BSD-3-Clause, © 2019 Laurence Lundblade; text in QCBOR-LICENSE | | cose-wg-examples.tsv | cose-wg/Examples: every message (output) and every ToBeSign, ToMac and AAD structure | commit 53c9d634 | Unlicense (public domain) | | spec-examples.tsv | RFC 8392 (CWT) Appendix A hex figures; RFC 8428 (SenML) Section 6 dump; WebAuthn Level 3 test vectors (attestationObject) | RFC text; w3c/webauthn commit 9d88b768 | IETF Trust Legal Provisions (code components, BSD-style); W3C Software and Document License |

Known upstream defects, found while importing:

QCBOR: three vectors declare a length other than the bytes they list. Two declare 6 bytes and list 4, so QCBOR's own test reads 2 bytes past its array. One declares 2 and lists 4. The fixture keeps what QCBOR's test actually reads: the listed bytes, cut to the declared length when that is shorter. Reported as laurencelundblade/QCBOR#412.
cose-wg/Examples: in x509-examples/signed-01.json and signed-02.json, the cbor_diag shows the kid header as a byte string (h'416C…'), while the cbor hex encodes it as the text string "Alice Lovelace". The hex is what was signed, so zucbor's notation follows it. COSE requires a byte string there, so it is the hex that is wrong. Reported as cose-wg/Examples#109.