Skip to content

Conversation

@ppicazo
Copy link
Contributor

@ppicazo ppicazo commented Nov 28, 2025

No description provided.

…ring proper signature verification and payload size limits
@ppicazo ppicazo changed the base branch from main to dev November 28, 2025 17:57
@rightup rightup requested a review from Copilot November 28, 2025 19:14
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request implements signature verification for advertisement packets to improve security by rejecting tampered or invalid adverts. The changes upgrade the signature scheme to cover the entire appdata instead of just the first 32 bytes, providing stronger integrity guarantees. The handler now validates signatures before processing adverts and filters out self-generated advertisements.

  • Changes the advertisement packet signature to cover the full appdata (not just the first 32 bytes)
  • Adds comprehensive signature verification in the AdvertHandler with proper error handling
  • Implements self-advert filtering to prevent nodes from processing their own broadcasts
  • Adds validation to enforce MAX_ADVERT_DATA_SIZE limit (96 bytes) in packet creation

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
src/pymc_core/protocol/packet_builder.py Updates signature to cover full appdata and adds size validation for advertisement data
src/pymc_core/node/handlers/advert.py Implements signature verification, component extraction, and self-advert filtering logic
tests/test_handlers.py Adds comprehensive tests for valid signatures, invalid signatures, and self-advert handling

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

@rightup
Copy link
Owner

rightup commented Nov 28, 2025

This pull request implements signature verification for advertisement packets to improve security by rejecting tampered or invalid adverts. The changes upgrade the signature scheme to cover the entire appdata instead of just the first 32 bytes, providing stronger integrity guarantees. The handler now validates signatures before processing adverts and filters out self-generated advertisements.

Changes the advertisement packet signature to cover the full appdata (not just the first 32 bytes)
Adds comprehensive signature verification in the AdvertHandler with proper error handling
Implements self-advert filtering to prevent nodes from processing their own broadcasts
Adds validation to enforce MAX_ADVERT_DATA_SIZE limit (96 bytes) in packet creation

@rightup rightup merged commit c43656f into rightup:dev Nov 28, 2025
@ppicazo ppicazo deleted the rejection_hurts branch November 28, 2025 19:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants