chore: Error handling

.github/workflows/ci.yml

@@ -87,7 +87,10 @@ jobs:
       - name: Materialise the full corpus
         run: bun scripts/generate-vectors.ts --full "${{ runner.temp }}/components-full-corpus.json"
 
-      # The runner image ships a stable Rust toolchain
+      # The runner ships rustup without a default toolchain; pick stable explicitly.
+      - name: Install the Rust toolchain
+        run: rustup toolchain install stable --profile minimal --no-self-update && rustup default stable
+
       - name: Fetch the pinned reference crates
         working-directory: tests/rust-validation
         run: cargo fetch --locked

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.0.0-beta.4 - 2026-09-17
+
+### Changed
+
+- The tag-40802 (SSH signature text form) summariser reports a malformed
+  PEM with the ssh-key text alone (`<error: PEM type label invalid>`), as
+  the reference's `tags_registry.rs` maps the error, not with the `SSH
+  operation failed: ` wrapper the `Ssh` code carries. The harness `summary`
+  rows `ssh signature bad pem` and `ssh signature not text` pin it.
+
 ## 1.0.0-beta.3 - 2026-09-15
 
 ### Added

CONTRIBUTING.md

@@ -11,7 +11,7 @@ We love your input! We want to make contributing to this project as easy and tra
 ## We Develop with Github
 We use GitHub to host code, to track issues and feature requests, and to accept Pull Requests.
 
-## Report Bugs using Github's [issues](https://github.com/briandk/transcriptase-atom/issues)
+## Report Bugs using Github's [issues](https://github.com/BlockchainCommons/bc-components/issues)
 
 If you find bugs, mistakes, or inconsistencies in this project's code or documents, please let us know by [opening a new issue](./issues), but consider searching through existing issues first to check and see if the problem has already been reported. If it has, it never hurts to add a quick "+1" or "I have this problem too". This helps prioritize the most common problems and requests.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockchaincommons/components",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.4",
   "type": "module",
   "sideEffects": false,
   "description": "A TypeScript implementation of Blockchain Commons cryptographic components. Supports key generation, signing, verification, encryption, and post-quantum cryptography.",
@@ -169,19 +169,19 @@
     "ajv": "^8.20.0",
     "pako": "^3.0.2",
     "@size-limit/preset-small-lib": "^13.1.1",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.6.1",
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
-    "@vitest/coverage-v8": "^5.0.0",
+    "@vitest/coverage-v8": "^5.0.1",
     "eslint": "^10.10.0",
-    "fast-check": "^4.10.0",
+    "fast-check": "^4.10.1",
     "prettier": "3.9.6",
     "publint": "^0.3.24",
     "size-limit": "^13.1.1",
     "tsdown": "^0.23.0",
     "typedoc": "^0.28.20",
     "typescript": "^7.0.2",
     "typescript6": "npm:typescript@^6.0.3",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.1"
   }
 }

src/tags.ts

@@ -50,6 +50,7 @@ import {
 import {
   ARID,
   CborJson,
+  ComponentsError,
   Digest,
   Nonce,
   PrivateKeyBase,
@@ -225,7 +226,17 @@ export function registerComponentSummarizers(store: TagsStore): void {
   store.setSummarizer(
     TAG_SSH_TEXT_SIGNATURE.value,
     summary((c) => {
-      SSHSignature.fromPem(expectText(c));
+      // The reference maps the ssh-key error's own text into the dcbor
+      // error (`SSHSignature::from_pem(...).map_err(|e| dcbor::Error::msg(e.to_string()))`),
+      // without the `SSH operation failed: ` wrapper `Ssh` carries.
+      try {
+        SSHSignature.fromPem(expectText(c));
+      } catch (e) {
+        if (ComponentsError.isComponentsError(e) && e.code === "Ssh" && "message" in e.details) {
+          throw CborError.custom(e.details.message);
+        }
+        throw e;
+      }
       return "SSHSignature";
     }),
   );

tests/__snapshots__/golden.test.ts.snap

@@ -2735,6 +2735,8 @@ exports[`golden: summaries > matches the snapshot 1`] = `
   "ok:SSHCertificate",
   "ok:SSHCertificate",
   "ok:SSHCertificate",
+  "error:PEM type label invalid",
+  "error:the decoded CBOR value was not the expected type",
   "error:the decoded CBOR value was not the expected type",
   "none",
   "untagged",

tests/corpus/corpus.ts

@@ -932,6 +932,12 @@ function* summaries(): Generator<Recipe> {
     ["ssh certificate uint", "d99f6300"],
     ["ssh certificate text", "d99f636178"],
     ["ssh certificate bytes", "d99f634100"],
+    // the signature text form: an ssh-key failure is reported with its own text
+    [
+      "ssh signature bad pem",
+      "d99f62781d2d2d2d2d2d424547494e20535348205349474e41545552452d2d2d2d2d",
+    ],
+    ["ssh signature not text", "d99f6200"],
     ["ssh private key not text", "d99f6000"],
     ["unknown tag 40999", "d9a027" + "00"],
     ["untagged", "00"],

tests/rust-validation/README.md

@@ -20,10 +20,10 @@ cargo run --release --offline --features agent -- target/corpus.json
 Result lines on 2026-09-15:
 
 ```
-5699 vectors - 5228 match, 323 panic-mapped (hang 3, none 2, panic 318), 148 js-only (J1 35, J2 21, J3 91, J4 1), 0 MISMATCH
-10332 vectors - 9745 match, 331 panic-mapped (hang 3, none 2, panic 326), 256 js-only (J1 35, J2 21, J3 199, J4 1), 0 MISMATCH
-5699 vectors - 5319 match, 323 panic-mapped (hang 3, none 2, panic 318), 57 js-only (J1 35, J2 21, J4 1), 0 MISMATCH [agent]
-10332 vectors - 9944 match, 331 panic-mapped (hang 3, none 2, panic 326), 57 js-only (J1 35, J2 21, J4 1), 0 MISMATCH [agent]
+5701 vectors - 5230 match, 323 panic-mapped (hang 3, none 2, panic 318), 148 js-only (J1 35, J2 21, J3 91, J4 1), 0 MISMATCH
+10334 vectors - 9747 match, 331 panic-mapped (hang 3, none 2, panic 326), 256 js-only (J1 35, J2 21, J3 199, J4 1), 0 MISMATCH
+5701 vectors - 5321 match, 323 panic-mapped (hang 3, none 2, panic 318), 57 js-only (J1 35, J2 21, J4 1), 0 MISMATCH [agent]
+10334 vectors - 9946 match, 331 panic-mapped (hang 3, none 2, panic 326), 57 js-only (J1 35, J2 21, J4 1), 0 MISMATCH [agent]
 ```
 
 ## What is compared