fix: normalize contract digest comparisons

Author: Aitomates

.github/workflows/contract-registry-live.yml

@@ -22,6 +22,13 @@ jobs:
         shell: python
         run: |
           import hashlib, json, os, pathlib, urllib.request
+
+          def canonical_bytes(data: bytes) -> bytes:
+              return data.replace(b"\r\n", b"\n").replace(b"\n", b"\r\n")
+
+          def sha256_hex(data: bytes) -> str:
+              return hashlib.sha256(canonical_bytes(data)).hexdigest()
+
           base = os.environ["REGISTRY_BASE"]
           version = os.environ["PINNED_VERSION"]
           root = pathlib.Path(os.environ["VENDORED_ROOT"])
@@ -33,9 +40,11 @@ jobs:
               manifest = json.load(response)
           for entry in manifest["schemas"]:
               local = (root / entry["path"]).read_bytes()
-              if hashlib.sha256(local).hexdigest() != entry["sha256"]:
+              if sha256_hex(local) != entry["sha256"]:
                   raise SystemExit(f"vendored digest drift: {entry['path']}")
               with urllib.request.urlopen(f"{base}/releases/v{version}/{entry['path']}", timeout=20) as response:
                   published = response.read()
-              if published != local:
+              if sha256_hex(published) != entry["sha256"]:
+                  raise SystemExit(f"published digest drift: {entry['path']}")
+              if canonical_bytes(published) != canonical_bytes(local):
                   raise SystemExit(f"published content drift: {entry['path']}")

src/GsdOrchestrator.Tests/ContractCompatibilityTests.cs

@@ -1,4 +1,5 @@
 using System.Security.Cryptography;
+using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
 using GsdOrchestrator.Workflows.Models;
@@ -36,6 +37,16 @@ public class ContractCompatibilityTests
     private static JsonNode LoadSchema(string name) =>
         JsonNode.Parse(File.ReadAllText(Path.Combine(ContractRoot, name)))!;
 
+    private static byte[] ReadCanonicalUtf8Bytes(string path)
+    {
+        var text = File.ReadAllText(path);
+        var normalized = text.ReplaceLineEndings("\r\n");
+        return Encoding.UTF8.GetBytes(normalized);
+    }
+
+    private static string Sha256Hex(byte[] bytes) =>
+        Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant();
+
     /// <summary>Walk up from the test output directory to find a sibling
     /// cas-contracts/registry/releases/v{version} checkout, or null if absent.</summary>
     private static string? ResolveUpstreamRoot()
@@ -121,12 +132,35 @@ public void VendoredRelease_MatchesManifestHashes()
         {
             var path = (string)entry!["path"]!;
             var expected = (string)entry["sha256"]!;
-            var bytes = File.ReadAllBytes(Path.Combine(ContractRoot, path));
-            var actual = Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant();
+            var bytes = ReadCanonicalUtf8Bytes(Path.Combine(ContractRoot, path));
+            var actual = Sha256Hex(bytes);
             Assert.Equal(expected, actual);
         }
     }
 
+    [Fact]
+    public void CanonicalSchemaDigest_IgnoresLineEndings()
+    {
+        var crlfPath = Path.GetTempFileName();
+        var lfPath = Path.GetTempFileName();
+
+        try
+        {
+            File.WriteAllText(crlfPath, "{\r\n  \"name\": \"schema\"\r\n}\r\n", new UTF8Encoding(false));
+            File.WriteAllText(lfPath, "{\n  \"name\": \"schema\"\n}\n", new UTF8Encoding(false));
+
+            var crlf = Sha256Hex(ReadCanonicalUtf8Bytes(crlfPath));
+            var lf = Sha256Hex(ReadCanonicalUtf8Bytes(lfPath));
+
+            Assert.Equal(crlf, lf);
+        }
+        finally
+        {
+            File.Delete(crlfPath);
+            File.Delete(lfPath);
+        }
+    }
+
     [Fact]
     public void PinnedVersion_IsTheVersionThisConsumerEmits()
     {
@@ -214,8 +248,8 @@ public void VendoredRelease_MatchesUpstreamSourceOfTruth()
         {
             var upstream = Path.Combine(upstreamRoot, Path.GetFileName(file));
             Assert.True(File.Exists(upstream), $"upstream missing {Path.GetFileName(file)}");
-            var local = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(file)));
-            var remote = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(upstream)));
+            var local = Sha256Hex(ReadCanonicalUtf8Bytes(file));
+            var remote = Sha256Hex(ReadCanonicalUtf8Bytes(upstream));
             Assert.Equal(remote, local);
         }
     }