[containarium-ci]

For #15: [S7] Fingerprint complete: Retire.js filecontent/hashes via regexp2 with timeout, header CPE table,…

This pull request does not close issue #15: not every checklist item is reported met.

What and why

The platform made the commits and the branch from the files the agent handed back; it does not use the agent's own git state on the box, so anything the summary says about committing, branching or pushing describes only what the agent could do there.

The agent's summary, quoted:

Adds content-based fingerprinting. `fingerprint.FromContent` runs `filecontent` patterns (with the
Retire.js `§§version§§` token) and SHA-1 `hashes` against fetched script bodies. Matching uses
regexp2 in ECMAScript mode with the existing 100 ms timeout; a timeout is returned as an error, not
a crash. The scanner now calls it for every 2xx script. React and Vue signatures are added, along
with fixture-bundle tests, a pathological-input ReDoS test and a hash test. A NOTICE file attributes
Retire.js (Apache-2.0). The header CPE table and the MAY_BE_BACKPORTED caveat already existed and
are unchanged. Not done: vendoring the full upstream jsrepository-v4.json and the scheduled update
workflow. Tests could not be run on this box (go and git were not permitted), so please run `go test
./...` in CI.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. Did not vendor the full jsrepository-v4.json: this box could not download it and I would not
   fabricate it. signatures.json stays a hand-curated subset in the Retire.js shape, with React and
   Vue added.
2. Did not add the scheduled upstream-sync workflow: files under .github cannot be part of this
   result. It needs a follow-up.
3. Content matches reuse EVIDENCE_KIND_FINGERPRINT_ASSET rather than adding a new proto enum value,
   to avoid a schema change; the evidence detail shows the matched text.
4. Added a Retire.js-compatible hashes extractor (SHA-1 of body to version) alongside filecontent,
   since the design names both; no library uses it yet.
5. The §§version§§ token in filecontent patterns expands to ([0-9][0-9.a-z_\-]+), the same capture
   Retire.js uses.
6. Did not add the Apache-2.0 license text for Retire.js separately; the repo LICENSE is already
   Apache-2.0, and NOTICE carries the attribution. Re-check when the real upstream file is vendored.
7. Header CPE table and MAY_BE_BACKPORTED were already implemented; left unchanged. IIS and Express
   rows from the design doc are still missing.
8. Tests, go vet and git operations were all blocked on this box, so nothing is verified and nothing
   is committed on agent/issue-15.

Changes

• NOTICE — 7 lines
• internal/fingerprint/data/signatures.json — 35 lines
• internal/fingerprint/fingerprint.go — 300 lines
• internal/fingerprint/fingerprint_test.go — 214 lines
• internal/service/scanner.go — 344 lines

5 file(s) in all.

Acceptance, from the issue

• ❌ not met Retire.js `jsrepository-v4.json` is vendored and embedded, with its Apache-2.0 license and a NOTICE attribution; a scheduled workflow opens a PR when upstream… — the agent says: Full jsrepository-v4.json not vendored and no scheduled workflow; NOTICE added, hand-curated subset only.
• 🟡 partly Every non-`func`/`ast` pattern compiles under `dlclark/regexp2` (ECMAScript mode) — signature-load test; matches run with a 100 ms timeout and a pathological-i… — the agent says: Timeout and ReDoS test added, but only the subset is compiled; tests not run.
• 🟡 partly React and Vue fixture bundles are detected by content; `Server`/`X-Powered-By` banners map to CPEs and always carry `MAY_BE_BACKPORTED` — the agent says: React/Vue content detection added; header CPEs and caveat pre-existed. Untested; IIS/Express rows missing.

The items are the issue's own; each status is the agent's report, which the platform has not checked.

Checks

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it. CI results appear on this pull request.

• Tests, as reported by the agent: not_run

How this pull request was made

Opened by the platform from a coding agent's run on a member's box (run 93a6cf50). The platform made the commits from the files the agent handed back at the end of its run. Nothing is merged automatically.