diff --git a/README.md b/README.md index 3ea7b3c..e7fcbb6 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # toml -A deterministic TOML subset encoder/decoder using only the standard library. +A deterministic TOML subset encoder/decoder using Go standard library. Requires Go 1.27.1. ```go @@ -93,14 +93,6 @@ comment tokens. Stop scanning on `TokenEOF` or `TokenError`. - Embedded struct fields are not promoted. Custom marshal interfaces are not supported. Decode input containers are the parser's generic maps/slices. -## Migration from the initial version +## License -Parsed integers now use `int64`, not machine-sized `int`. Update type assertions -on raw parser results. Typed struct destinations keep their declared types. -Previously lossy numeric conversions and nil array elements now error. Mixed -arrays can now be encoded. All changes have regression and fuzz coverage. - -Run `go test -race ./...`, `GOARCH=386 go test ./...`, and, for example, -`go test -run '^$' -fuzz '^FuzzRoundTrip$' -fuzztime=30s`. - -BSD-3-Clause; see LICENSE. +BSD-3-Clause diff --git a/doc/audit.md b/doc/audit.md deleted file mode 100644 index 6156798..0000000 --- a/doc/audit.md +++ /dev/null @@ -1,59 +0,0 @@ -# Configuration integration audit - -The audit fixes concrete failures in the original release: - -- Numeric conversion truncated fractions, accepted float values outside integer - range, rejected ordinary `uint` input, and could not decode full `uint64`. - Checked conversions now operate in the source integer domain and reject loss. -- Parser integers depended on 64-bit `int`. They are now explicitly `int64`; - narrowed destinations retain overflow checks on every architecture. -- Failed decoding could partially overwrite a destination; decoding now commits - only after success. Named string map keys no longer panic, and tags with an - empty name correctly fall back to the field name. Existing pointer defaults - survive updates, and errors do not mutate the original pointee or containers. -- Fixed arrays could be encoded but not decoded. They now decode with exact - length and element-range checks, including nested arrays and arrays of tables. -- Nested table headers failed to quote their component keys. Arrays of interface - table values could encode empty tables. Mixed/nested arrays now encode using - inline tables, and nested keys use the same escaping as scalar keys. -- Backspace/form-feed strings did not decode the escapes emitted by Marshal. - Invalid UTF-8, raw string controls, missing array/inline-table commas and - missing statement separators are rejected. -- Cyclic encoding could overflow the stack. Encoding/decoding and dotted paths - now have depth limits. Numeric keys and unsupported uint64 literals fail - explicitly instead of generating unreadable output. Nil array elements error. -- Numeric key checks now cover decimal keys of any length, including values - beyond int64; the parser and encoder apply the same restriction. -- Formatting an invalid unsigned input could recurse through a cyclic map. - Conversion errors now report the source type without formatting its contents. -- Map decoding and encoder entry collection preallocate from known sizes. All - operation state stays local; no global cache or lock was added. - -No datetime, custom marshal interface, literal-string or multiline-string -feature was added. The supported subset and remaining deviations are in README. - -This branch consolidates the prior `audit/numeric-hardening-20260928` and -`audit/config-roundtrip-hardening` commits, retaining both in its ancestry. -Only this repository is changed. Consumer migration, watcher publication and -snapshot ownership remain work for the separate config audit. - -Verification for this pass: unit and race suites and `go vet` pass on Go 1.27.1; -the 386 test binary cross-compiles. This host cannot execute 386 binaries, so CI -executes that suite. The first CI run caught a test fixture that cast an int64 -through machine-sized int before Decode; that fixture now retains its int64. -Regression tests for fixed arrays, pointer defaults and oversized numeric keys -were also run against recovered commit `6384895` and reproduced the failures. - -The 15-second round-trip fuzz run passed 71,221 executions. Its property now -fails on unexpected Marshal errors instead of silently skipping them; only the -documented whole-tree depth bound is excluded. Integer fuzzing covers full -uint64 preservation, signed boundaries and uint8 narrowing. CI runs these bounded -fuzz checks on every push and pull request. Refer to the PR checks for final CI -results. - -Integration limits: parsed integers are int64; raw assertions must migrate. -Direct Decode can retain the full uint64 range, but file encoding rejects values -above MaxInt64. Interface destinations retain source references, so config must -own its snapshots. Comment text can be collected with the existing lexer and -written as a preamble; Marshal does not preserve source positions. README -documents these contracts and the intentionally limited TOML syntax.