Robust CBOR deserialization for IssuerSignedItem/List with deferred element identifier by nodh · Pull Request #531 · a-sit-plus/vck

nodh · 2026-03-02T14:34:13Z

Mitigate errors like #311 by preventing deserialization of IssuerSignedItem without a namespace. Our code relies on deserializing IssuerSignedList instead, which has two advantages: Always has a namespace and uses OBOR generic CBOR parsing elementValue which should at least return the CBOR byte array as a fallback.

Started with the help of codex 5.3 high.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 572bebaae0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63676a3cca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c55911e40a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 715811254c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f70bc527bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt

nodh · 2026-03-11T09:43:58Z

pinging @JesusMcCloud

JesusMcCloud

Looking good.

JesusMcCloud · 2026-03-12T15:26:36Z

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt

+
+    private fun CborMap.toIssuerSignedItem(): IssuerSignedItem {
+        val digestId = coseCompliantSerializer.decodeFromByteArray(
+            Long.serializer(),


long or ulong? important for KxS 1.10

In the CDDL it's uint, so major type 0. But there is no encodeUIntElement, so is it safe to use encodeLongElement or not?

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db9c163880

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-13T10:38:18Z

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt

+        runCatching { return coseCompliantSerializer.decodeFromByteArray(InstantStringSerializer, bytes) }
+        runCatching { return coseCompliantSerializer.decodeFromByteArray(String.serializer(), bytes) }
+        runCatching { return coseCompliantSerializer.decodeFromByteArray(Long.serializer(), bytes) }
+        runCatching { return coseCompliantSerializer.decodeFromByteArray(Float.serializer(), bytes) }


Decode Double before Float in generic fallback

In decodeGenericElementValue, Float.serializer() is attempted before Double.serializer(), so unregistered 64-bit floating-point claims parsed via deserializeFromOborMap can be downcast to Float before Double is ever tried. This changes both runtime type and precision for valid double-valued elementValue fields in IssuerSignedList, which can break round-trips and numeric comparisons for consumers that expect full Double fidelity.

Useful? React with 👍 / 👎.

nodh added the codex label Mar 2, 2026 — with ChatGPT Codex Connector

chatgpt-codex-connector bot reviewed Mar 2, 2026

View reviewed changes

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt Outdated Show resolved Hide resolved

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt Outdated Show resolved Hide resolved

nodh force-pushed the codex/add-tests-for-deserializing-elementvalue-error branch from c6fbb45 to aaad495 Compare March 2, 2026 18:47

nodh changed the base branch from main to develop March 2, 2026 19:47

nodh self-assigned this Mar 2, 2026

nodh requested a review from JesusMcCloud March 2, 2026 19:58

nodh added this to the 5.12.0 milestone Mar 2, 2026

nodh mentioned this pull request Mar 2, 2026

PID ISO Mdoc format cannot be parsed IssuerSigned on Android only #526

Open

chatgpt-codex-connector bot reviewed Mar 3, 2026

View reviewed changes

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt Outdated Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Mar 3, 2026

View reviewed changes

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt Show resolved Hide resolved

nodh force-pushed the codex/add-tests-for-deserializing-elementvalue-error branch from b049fab to 7158112 Compare March 3, 2026 17:23

chatgpt-codex-connector bot reviewed Mar 3, 2026

View reviewed changes

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt Outdated Show resolved Hide resolved

nodh force-pushed the codex/add-tests-for-deserializing-elementvalue-error branch from cdf31bb to e9fb71a Compare March 3, 2026 17:57

chatgpt-codex-connector bot reviewed Mar 3, 2026

View reviewed changes

openid-data-classes/src/commonMain/kotlin/at/asitplus/iso/IssuerSignedItemSerializer.kt Outdated Show resolved Hide resolved

nodh marked this pull request as draft March 3, 2026 18:20

nodh marked this pull request as ready for review March 4, 2026 09:14

JesusMcCloud approved these changes Mar 12, 2026

View reviewed changes

nodh requested a review from JesusMcCloud March 13, 2026 10:28

nodh and others added 10 commits March 13, 2026 11:28

Use obor container for issuer signed element value decoding

a745c32

Unify issuer-signed obor deserialization in item serializer

39d55f8

Use deferred OBOR item deserializer in IssuerSignedList

1a12a18

Use generic OBOR decoding whenever possible

aef5619

Prevent direct deserialization of IssuerSigned items

8733a51

ISO: Split out test cases

c359fef

ISO: Reorganize tests

daa7b03

ISO: Allow for namespaced deserializing of IssuerSignedItem

7f8446c

ISO: Another fallback for parsing element values in IssuerSignedItem

53bfefa

ISO: Put back fallback deserialization in IssuerSignedItem

db9c163

nodh force-pushed the codex/add-tests-for-deserializing-elementvalue-error branch from d5fb5a0 to db9c163 Compare March 13, 2026 10:28

chatgpt-codex-connector bot reviewed Mar 13, 2026

View reviewed changes

Conversation

nodh commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

nodh commented Mar 11, 2026

Uh oh!

JesusMcCloud left a comment

Choose a reason for hiding this comment

Uh oh!

JesusMcCloud Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

nodh Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nodh commented Mar 2, 2026 •

edited

Loading