Local test, scan, dependency, archive and family-reference audits

Match the report to the exported task

Use JUnit when CI has already run tests and only exported XML remains. Use CycloneDX when a generated SBOM has contradictory references. Use GEDCOM when a family export has one-way pointers or declared ancestor loops. A generic XML/JSON formatter cannot decide these relationships.

Select a local file or use a complete paste. The table preview is limited to 200 rows, while successful downloads contain every scoped result. Keep the original exports beside the reports. No test runner, SBOM package install, family import, remote reference fetch or user script runs.

Count JUnit cases separately from their events

The starter contains three cases: one passed, one with two failure events and one skipped. Its summary has one failure case and three outcome events. A testcase combining skipped and failure is mixed. Duplicate names have distinct indices and are never merged.

Suite/container declared counters and wall-clock time remain independent from testcase counts. measuredSeconds is the sum of testcase times only when every case supplies a finite nonnegative time; absent time makes it unknown. The starter container time is 99, while its measured case time is about 0.3.

Nested testsuites/testsuites and testsuite/testcase, ordinary properties and logs are supported. Unknown outcome attributes/elements, flaky/rerun extensions and DTD/entities reject. An empty suite must explicitly declare zero tests. The complete offline HTML escapes logs, failure messages and property text instead of rendering user HTML. Original XML is retained by you, rather than duplicated in downloads.

SARIF: preserve findings when a source base is unresolved

The starter has four results and five primary/related/code-flow locations. R1 resolves to the driver rule’s error level; missing bases, a base cycle and an unlocated result remain visible. Supplying {"ROOT":"file:///D:/new/"} maps the SRC chain to D:/new/src/ without reading source files there. Complete original results retain baseline, suppressions and unknown fields.

Bases must be directory URIs ending in /, without queries or fragments. Invalid indices and conflicting direct/indexed declarations reject; undeclared rules and unknown suppression/baseline states stay explicit. Message markdown is literal escaped text; messageStrings and arguments are not expanded. report.json retains complete originalResult number tokens and original.sarif.json retains input bytes. CSV and HTML list every scoped location plus unlocated results, without certifying the full SARIF schema.

Keep ambiguous SBOM references out of the graph

The starter root app depends on A, A on B, and B back on A. The report shows an A/B SCC plus separate missing and external URN targets. An SCC is a declared dependency cycle, not automatically an invalid or insecure result.

Every bom-ref in the original is indexed with its JSON pointer. Duplicate declarations expose all paths; edges that touch ambiguous declarations are excluded. Duplicated dependency source rows also stay explicit and are excluded. Other objects cannot stand in for component/service targets.

Root reachability is evaluated only with an explicit, unique metadata.component bom-ref. original.json retains all original bytes and numeric tokens. Provides, compositions, formulation, vulnerabilities and other relationship objects remain outside dependency analysis. Only version 1.6 is accepted, with basic structure checks; full official schema validation, vulnerability scanning and compliance decisions remain separate.

Wheel: generating a report does not mean integrity passed

Load the fixed demo_pkg-1.2.3-py2.py3-none-any.whl example: six archive files, five verified payload files and the unhashed RECORD itself. Expanded filename tags are compared with WHEEL; names normalize but versions compare literally. Folded/repeated METADATA headers and entry points remain literal data. Actual 32 MiB input, 64 MiB expanded and 10,000-entry vectors have Node Worker capacity/readback evidence; production-browser acceptance remains centralized.

A bad hash, wrong size, missing/unrecorded file or metadata mismatch yields a complete integrityStatus=failed diagnosis. SHA256/384/512 are supported; SHA224 and unknown hashes are explicitly incomplete, while MD5/SHA1 are forbidden and fail. RECORD self and legacy jws/p7s exceptions stay visible. verified_recorded_payload does not establish authenticity, safety or your machine ABI; nothing is installed, imported, executed or unpacked to disk.

• Keep the original wheel filename and check failures with a trusted producer; do not rewrite RECORD to conceal changes.
• This task audits the selected wheel, not an installed disk copy. Historical pip feedback demonstrates demand without claiming current pip behavior.

Treat GEDCOM links as declarations requiring evidence

The starter has an adopted parent-child declaration and a missing CHIL target. Each issue carries the original line. INDI FAMC/FAMS must point to FAM, while FAM CHIL/HUSB/WIFE must point to INDI. Missing reverse declarations are reported, not created.

Ancestor SCCs use directed declared parent-to-child edges. Adopted, foster, sealing, birth and unknown/multiple pedigree values remain visible; the graph does not establish biological facts. Spouse rings do not become ancestor cycles. Unknown tags and original UTF-8 BOM/newline bytes remain available.

CONT adds the preceding physical newline and CONC concatenates text. Values longer than 4096 UTF-8 bytes use value:null with external-original-value plus an exact span in original.ged; a logical continued value uses ordered byte/literal segments joined by concat. These nulls are present values stored in the original, not missing fields. Download original.ged with the JSON and reconstruct the specified bytes when reviewing long text.

Use all budgets together and recover from the actual failure

A supported input can exceed the complete 10 MiB download budget before its row-count limit. Such failures return no partial report. Do not discard unknown records to force a result; correct or partition in the producer only when the task remains meaningful.

When report JSON exceeds 20,000 characters, the result text and copy button provide a compact preview with row counts and fullReportInDownload:true. Download report.json/CSV/HTML for the complete handoff.

The table shows the first 200 rows; longer cells show their first 2,000 characters plus an ellipsis. Above 20,000 characters, text/copy is a summary preview. Full JSON/CSV/HTML are not truncated; the receiver should read downloaded files instead of treating copied previews as complete reports.

• JUnit: re-export unsupported producer outcomes; do not relabel flaky events as passes.
• CycloneDX: fix uniqueness and target references in the generator, then rerun; unresolved external URNs need their own workflow.
• GEDCOM: repair format/version/encoding or duplicate xrefs in the source system; check one-way links against evidence before editing.
• After cancellation, rerun a valid source. Keep complete downloads rather than treating the first-200 preview as a final artifact.

Tools used in this article