osantana / prettyconf / 30953225491

99%

push

github

Validate base64 as canonical encoding on every supported python

CPython only rejects malformed base64 padding consistently from 3.12.10 on,
so `YWJj===` decoded fine on some interpreters and raised on others,
including between patch releases of 3.12. A credential with a broken value
was accepted or rejected depending on which interpreter ran the
application.

The cast now requires the value to be the canonical encoding of what it
decodes to. That rule is version-independent, reads on its own, and also
rejects non-canonical trailing bits that every CPython version accepted.

Add `make test-all`, which runs the suite against every supported version
locally. This is how the divergence was found: CI would have caught it on
the 3.11 job, but there was no way to reproduce the matrix before pushing.

Add `make check-versions`, wired into `make lint`, so the CI matrix cannot
silently drift from the classifiers in pyproject.toml.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

8 of 8 new or added lines in 1 file covered. (100.0%)

1080 of 1090 relevant lines covered (99.08%)

4.95 hits per line