{"record":{"id":"825cf3b62b030a43","repo":"JuliusBrussee/caveman","slug":"unsupported-unsigned-verification-coverage-strin","errorCode":null,"errorMessage":"unsupported unsigned verification coverage ${String(bundle.verification_coverage)}","messagePattern":"unsupported unsigned verification coverage (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/index.ts","lineNumber":17412,"sourceCode":"  if (typeof info.key !== \"string\" || !info.key.trim()) throw new Error(`${label} key is required`);\n  const raw = Buffer.from(info.key, \"base64\");\n  if (raw.length !== 32 || raw.toString(\"base64\") !== info.key) throw new Error(`${label} must be a canonical base64 Ed25519 public key`);\n  return { info, raw, key: ed25519PublicKey(raw) };\n}\n\nfunction decodeUniqueKeyring(infos: ReceiptPublicKey[], label: string): Map<string, DecodedReceiptKey> {\n  const keys = new Map<string, DecodedReceiptKey>();\n  for (const [index, info] of infos.entries()) {\n    const decoded = decodeReceiptKey(info, `${label}[${index}]`);\n    if (keys.has(decoded.info.key_id)) throw new Error(`${label} contains duplicate key_id ${decoded.info.key_id}`);\n    keys.set(decoded.info.key_id, decoded);\n  }\n  return keys;\n}\n\nfunction embeddedReceiptKeys(bundle: ReceiptBundle): { current: DecodedReceiptKey; keys: Map<string, DecodedReceiptKey> } {\n  if (bundle.schema !== RECEIPT_BUNDLE_V1 && bundle.schema !== RECEIPT_BUNDLE_V2) throw new Error(`unsupported bundle schema ${String(bundle.schema)}`);\n  if (bundle.verification_coverage !== undefined && bundle.verification_coverage !== INCLUDED_RECEIPTS_ONLY) throw new Error(`unsupported unsigned verification coverage ${String(bundle.verification_coverage)}`);\n  if (bundle.completeness_attested === true) throw new Error(\"bundle completeness cannot be attested by unsigned export metadata\");\n  const current = decodeReceiptKey(bundle.public_key, \"public_key\");\n  if (bundle.public_keys !== undefined && !Array.isArray(bundle.public_keys)) throw new Error(\"public_keys must be an array\");\n  if (bundle.schema === RECEIPT_BUNDLE_V2 && (!Array.isArray(bundle.public_keys) || bundle.public_keys.length === 0)) throw new Error(\"v2 bundle requires public_keys\");\n  const keys = decodeUniqueKeyring(bundle.public_keys ?? [], \"public_keys\");\n  const currentInRing = keys.get(current.info.key_id);\n  if (currentInRing && !currentInRing.raw.equals(current.raw)) throw new Error(`public_key conflicts with public_keys entry ${current.info.key_id}`);\n  if (bundle.schema === RECEIPT_BUNDLE_V2 && !currentInRing) throw new Error(\"v2 public_keys must include public_key\");\n  if (!currentInRing) keys.set(current.info.key_id, current);\n  return { current, keys };\n}\n\nasync function pinnedReceiptKeys(file: string, current: DecodedReceiptKey): Promise<{ keys: Map<string, DecodedReceiptKey>; trust: string }> {\n  const source = (await readFile(file, \"utf8\")).trim();\n  if (!source.startsWith(\"{\")) {\n    const pinned = decodeReceiptKey({ ...current.info, key: source }, \"--pubkey\");\n    if (!pinned.raw.equals(current.raw)) throw new Error(\"bundle public key does not match the published --pubkey\");\n    return { keys: new Map([[current.info.key_id, pinned]]), trust: \"pinned_public_key\" };","sourceCodeStart":17394,"sourceCodeEnd":17430,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/5184b3d11ac6a1acb7d44b9bfaa31698157cff97/packages/cli/src/index.ts#L17394-L17430","documentation":"The optional bundle field verification_coverage may only be \"included_receipts_only\". The verifier can only check receipts physically present in the bundle, so any broader coverage claim carried in unsigned export metadata is an unverifiable promise and is rejected.","triggerScenarios":"A bundle exported with verification_coverage set to something other than \"included_receipts_only\" (e.g. \"all_receipts\", \"complete\", or a new enum value from a newer producer).","commonSituations":"A newer producer adds a coverage mode the local CLI does not know; someone hand-sets the field trying to claim full coverage; copy-paste from internal docs.","solutions":["Re-export the bundle with verification_coverage omitted or set exactly to \"included_receipts_only\"","Upgrade the verifying CLI if the newer coverage value is legitimately defined by a newer schema","Do not hand-set this field on exported bundles"],"exampleFix":"// before\n{ \"verification_coverage\": \"all_receipts\" }\n\n// after\n{ \"verification_coverage\": \"included_receipts_only\" }","handlingStrategy":"validation","validationCode":"if (bundle.verification_coverage !== undefined && bundle.verification_coverage !== \"included_receipts_only\") {\n  throw new Error(`refusing bundle with coverage claim ${String(bundle.verification_coverage)}`);\n}","typeGuard":"function hasValidCoverage(v: unknown): boolean {\n  return v === undefined || v === \"included_receipts_only\";\n}","tryCatchPattern":"try { execSync(`caveman receipts verify ${bundle}`); }\ncatch (e) {\n  if (/unsupported unsigned verification coverage/.test(String((e as Error).message))) {\n    fail(\"re-export the bundle; only included_receipts_only coverage is verifiable\");\n  }\n  throw e;\n}","preventionTips":["Never hand-set verification_coverage on exported bundles","Keep producers and verifiers on compatible schema versions","Treat unexpected coverage values as producer bugs, not as data to normalize away"],"tags":["receipts","verification-coverage","schema-validation","validation"],"backgroundTag":"unsupported-field-value","analyzedSha":"5184b3d11ac6a1acb7d44b9bfaa31698157cff97","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}