You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by gi...@apache.org on 2026/05/06 16:13:06 UTC
(tooling-docs) branch asf-site updated: Automatic Site Publish by Buildbot
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/tooling-docs.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 887ea8b Automatic Site Publish by Buildbot
887ea8b is described below
commit 887ea8b669e2813869841b307c330f08404068df
Author: buildbot <us...@infra.apache.org>
AuthorDate: Wed May 6 16:13:02 2026 +0000
Automatic Site Publish by Buildbot
---
output/_pagefind/fragment/en_35ad67e.pf_fragment | Bin 0 -> 10061 bytes
output/_pagefind/fragment/en_b555ef9.pf_fragment | Bin 9990 -> 0 bytes
output/_pagefind/index/en_2c86e11.pf_index | Bin 0 -> 9720 bytes
output/_pagefind/index/en_6ff56ac.pf_index | Bin 0 -> 41342 bytes
output/_pagefind/index/en_ddab7c9.pf_index | Bin 9591 -> 0 bytes
output/_pagefind/index/en_f485b42.pf_index | Bin 41340 -> 0 bytes
output/_pagefind/pagefind-entry.json | 2 +-
output/_pagefind/pagefind.en_14488a8fdb.pf_meta | Bin 217 -> 0 bytes
output/_pagefind/pagefind.en_c7b6f0ec1b.pf_meta | Bin 0 -> 214 bytes
output/noisy-secrets.html | 22 +++++++++-------------
10 files changed, 10 insertions(+), 14 deletions(-)
diff --git a/output/_pagefind/fragment/en_35ad67e.pf_fragment b/output/_pagefind/fragment/en_35ad67e.pf_fragment
new file mode 100644
index 0000000..d10e1c6
Binary files /dev/null and b/output/_pagefind/fragment/en_35ad67e.pf_fragment differ
diff --git a/output/_pagefind/fragment/en_b555ef9.pf_fragment b/output/_pagefind/fragment/en_b555ef9.pf_fragment
deleted file mode 100644
index d27a063..0000000
Binary files a/output/_pagefind/fragment/en_b555ef9.pf_fragment and /dev/null differ
diff --git a/output/_pagefind/index/en_2c86e11.pf_index b/output/_pagefind/index/en_2c86e11.pf_index
new file mode 100644
index 0000000..b25eaee
Binary files /dev/null and b/output/_pagefind/index/en_2c86e11.pf_index differ
diff --git a/output/_pagefind/index/en_6ff56ac.pf_index b/output/_pagefind/index/en_6ff56ac.pf_index
new file mode 100644
index 0000000..f67d95f
Binary files /dev/null and b/output/_pagefind/index/en_6ff56ac.pf_index differ
diff --git a/output/_pagefind/index/en_ddab7c9.pf_index b/output/_pagefind/index/en_ddab7c9.pf_index
deleted file mode 100644
index dda8efc..0000000
Binary files a/output/_pagefind/index/en_ddab7c9.pf_index and /dev/null differ
diff --git a/output/_pagefind/index/en_f485b42.pf_index b/output/_pagefind/index/en_f485b42.pf_index
deleted file mode 100644
index b4b84b4..0000000
Binary files a/output/_pagefind/index/en_f485b42.pf_index and /dev/null differ
diff --git a/output/_pagefind/pagefind-entry.json b/output/_pagefind/pagefind-entry.json
index 0a44eea..3996b65 100644
--- a/output/_pagefind/pagefind-entry.json
+++ b/output/_pagefind/pagefind-entry.json
@@ -1 +1 @@
-{"version":"1.0.4","languages":{"en":{"hash":"en_14488a8fdb","wasm":"en","page_count":14}}}
\ No newline at end of file
+{"version":"1.0.4","languages":{"en":{"hash":"en_c7b6f0ec1b","wasm":"en","page_count":14}}}
\ No newline at end of file
diff --git a/output/_pagefind/pagefind.en_14488a8fdb.pf_meta b/output/_pagefind/pagefind.en_14488a8fdb.pf_meta
deleted file mode 100644
index 86af751..0000000
Binary files a/output/_pagefind/pagefind.en_14488a8fdb.pf_meta and /dev/null differ
diff --git a/output/_pagefind/pagefind.en_c7b6f0ec1b.pf_meta b/output/_pagefind/pagefind.en_c7b6f0ec1b.pf_meta
new file mode 100644
index 0000000..9f3b627
Binary files /dev/null and b/output/_pagefind/pagefind.en_c7b6f0ec1b.pf_meta differ
diff --git a/output/noisy-secrets.html b/output/noisy-secrets.html
index dcf52c4..789f47d 100644
--- a/output/noisy-secrets.html
+++ b/output/noisy-secrets.html
@@ -139,7 +139,7 @@
<h1>
Noisy Secrets
</h1>
- <p>Draft Specification, 2026-04-03.</p>
+ <p>Draft Specification, 2026-05-06.</p>
<p>Not intended for review outside of the Apache Software Foundation.</p>
<h2>1. Abstract</h2>
<p>Noisy Secrets are bearer credentials which are designed to be easy to detect when leaked. They contain checksums for validation, and may optionally contain a namespace to provide a hint to identify the issuing party for leak reports.</p>
@@ -409,17 +409,7 @@ z -> 32
<h3>9.9. Scanning</h3>
<p>Implementations often scan large bodies of text for possible Noisy Secrets. Regular expressions are useful for identifying Candidates, but a regular expression alone cannot validate the Interleaved Checksum Tag. Therefore a scanner MUST apply the validation algorithm in Section 7 to every regex match before treating it as a Noisy Secret Tag unless false positives are acceptable.</p>
<p>Scanning MUST be case-sensitive and ASCII-based. Implementations SHOULD use explicit ASCII character classes and SHOULD NOT use <code>\w</code>, <code>\d</code>, <code>\s</code>, <code>\b</code>, locale-sensitive matching, Unicode case folding, or normalization. In particular, <code>\b</code> is not suitable because underscore (<code>_</code>) is part of <code>BASE37</code>.</p>
-<p>For the regexes below, the alphabets are manifested as:</p>
-<pre><code>BASE37 = [0-9_a-z]
-BASE36 = [0-9a-z]
-BASE32 = [2-9a-km-np-z]
-</code></pre>
-<p>A general regex for all Noisy Secret Strings is:</p>
-<pre><code>secret_(?:2|[4-9a-km-np-z]_[0-9a-z](?:[0-9_a-z]{0,28}[0-9a-z])?)_[2-9a-km-np-z]{32}[0-9_a-z]{8}
-</code></pre>
-<p>This is only a scanner prefilter. It will also match strings that are not actually Noisy Secret Tags, especially ones where the Namespace String is syntactically plausible but the leading length-prefix character does not agree with the actual namespace length, and ones where the final 8 BASE37 characters are not the correct interleaved even and odd Reed-Solomon checksums for the preceding Namespace and Payload. It may also match syntactically valid NamespaceString values that could no [...]
-<p>Scanners MAY instead use specialised regexes for each length-prefixed subset.
-These are:</p>
+<p>The Prefix production in Section 4.1 is only a syntactic fragment. It was chosen to be concise, and to make room for the Namespace String. The conceptual prefix of a Noisy Secret is the Prefix, Pad, Namespace length prefix, and Pad. This longer conceptual prefix is much more likely to distinguish Noisy Secrets from other strings. Scanners SHOULD therefore use the following specialised regexes for each length-prefixed subset as prefilters:</p>
<pre><code>2: secret_2_[2-9a-km-np-z]{32}[0-9_a-z]{8}
4: secret_4_[0-9a-z]_[2-9a-km-np-z]{32}[0-9_a-z]{8}
5: secret_5_[0-9a-z]{2}_[2-9a-km-np-z]{32}[0-9_a-z]{8}
@@ -452,7 +442,12 @@ x: secret_x_[0-9a-z][0-9_a-z]{26}[0-9a-z]_[2-9a-km-np-z]{32}[0-9_a-z]{8}
y: secret_y_[0-9a-z][0-9_a-z]{27}[0-9a-z]_[2-9a-km-np-z]{32}[0-9_a-z]{8}
z: secret_z_[0-9a-z][0-9_a-z]{28}[0-9a-z]_[2-9a-km-np-z]{32}[0-9_a-z]{8}
</code></pre>
-<p>A scanner MAY use a literal prefilter for the fixed substring <code>secret_</code> before applying one or more regexes from this section. After a match has been validated as a Noisy Secret Tag, the implementation MAY obtain a Candidate Domain as described in Section 9.8 for reporting or routing purposes.</p>
+<p>For the regexes above, the alphabets are manifested as:</p>
+<pre><code>BASE37 = [0-9_a-z]
+BASE36 = [0-9a-z]
+BASE32 = [2-9a-km-np-z]
+</code></pre>
+<p>Because these regexes are only prefilters, they will also match strings that are not actually Noisy Secret Tags, such as ones where the final 8 <code>BASE37</code> characters are not the correct interleaved even and odd Reed-Solomon checksums for the preceding Namespace and Payload. They may also match syntactically valid NamespaceString values that could not have been produced from a real FQDN by the namespace construction algorithm. After a match has been validated as a Noisy Secret [...]
<p>The regexes in this section are for contiguous exact strings only. Detection of values that have been line-wrapped, whitespace-separated, truncated, or otherwise transformed is out of scope for this specification.</p>
<h2>10. References</h2>
<h3>10.1. Normative References</h3>
@@ -467,6 +462,7 @@ z: secret_z_[0-9a-z][0-9_a-z]{28}[0-9a-z]_[2-9a-km-np-z]{32}[0-9_a-z]{8}
<p>Costello, A., "Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA)", RFC 3492, DOI 10.17487/RFC3492, March 2003, <a href="https://www.rfc-editor.org/info/rfc3492">https://www.rfc-editor.org/info/rfc3492</a>.</p>
<p>Reed, I. S. and G. Solomon, "Polynomial Codes Over Certain Finite Fields", Journal of the Society for Industrial and Applied Mathematics, Vol. 8, No. 2, pp. 300-304, June 1960, DOI 10.1137/0108018, <a href="https://doi.org/10.1137/0108018">https://doi.org/10.1137/0108018</a>.</p>
<h2>Appendix A. Test Vectors</h2>
+<p>The values in this appendix are Noisy Secret Tags, not issued Noisy Secrets. They are test vectors for the construction and validation algorithms, with valid checksums, but their Payload values are fixed test inputs rather than values generated as specified in Section 5.5.</p>
<h3>Appendix A.1. Vector 1</h3>
<pre><code>FQDN:
none
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org