fix(render-client): verify a first revision that ends with a lone CR

The parent writes `\n` before its update, so a first revision ending
`%%EOF\r` is followed by `\r\n` in the sealed file, and its true end
falls between the two. The client tried only the marker's end and the
end of the whole end-of-line, and refused that seal as a protocol
error. It now tries every end through the end-of-line.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

crates/registry-render-client/src/lib.rs

@@ -662,7 +662,7 @@ fn bounded_version_and_warnings(document_type: &str, version: &str, warnings: &[
 
 /// Whether `document_hex`, a lowercase hex SHA-256, is that of a prefix of
 /// `pdf` that ends at a `%%EOF` marker, optionally followed by its
-/// end-of-line. Found by byte search; the PDF is not parsed, so a marker
+/// end-of-line or the `\r` of a `\r\n`. Found by byte search; the PDF is not parsed, so a marker
 /// inside a stream is a candidate too. A prefix equal to the whole file is
 /// not a first revision.
 ///
@@ -686,7 +686,9 @@ fn first_revision_matches(pdf: &[u8], document_hex: &str) -> bool {
             [b'\r' | b'\n', ..] => 1,
             _ => 0,
         };
-        for end in [marker_end, marker_end + eol] {
+        // Every end through the end-of-line: a first revision that ends
+        // `%%EOF\r` is followed by the `\n` the update starts with.
+        for end in marker_end..=marker_end + eol {
             if end >= pdf.len() {
                 break;
             }
@@ -695,9 +697,6 @@ fn first_revision_matches(pdf: &[u8], document_hex: &str) -> bool {
             if running.clone().finalize().as_slice() == expected.as_slice() {
                 return true;
             }
-            if eol == 0 {
-                break;
-            }
         }
     }
     false

crates/registry-render-client/tests/seal.rs

@@ -322,6 +322,20 @@ async fn first_revision_hash_may_exclude_the_line_ending() {
     assert!(seal_with(200, body, None, None).await.is_ok());
 }
 
+/// The parent writes `\n` before its update, so a first revision that ends
+/// `%%EOF\r` is followed by `\r\n` in the sealed file, and its hash ends
+/// between the two.
+#[tokio::test]
+async fn first_revision_hash_may_end_at_a_lone_carriage_return() {
+    let first_revision = b"%PDF-1.7\n1 0 obj<<>>endobj\ntrailer<<>>\n%%EOF\r";
+    let mut body = sealed_body_for(&[&first_revision[..], b"\n"].concat(), "B-B");
+    body["documentDigest"] = json!(sha(first_revision));
+    let sealed = seal_with(200, body, None, None)
+        .await
+        .expect("a first revision that ends with a carriage return");
+    assert_eq!(sealed.pdf, [&first_revision[..], b"\n", UPDATE].concat());
+}
+
 /// A stream may hold `%%EOF` as data, as a JPEG comment does, any number of
 /// times before the end marker of the first revision.
 #[tokio::test]