view release on metacpan or  search on metacpan

docs/adr/0045-an-env-comment-lives-under-the-empty-key-because-that-is-the-path-it-authenticates-under.md  view on Meta::CPAN

### 2. The MAC of that document, recomputed here

The digest was rebuilt from the document with this distribution's modules —
`Metadata::Flat->unflatten`, `Metadata->from_hash`, `Backend::Age`,
`Encrypted->parse`/`decrypt_bytes` — and compared with the plaintext of the
document's own `sops_mac`:

```
computed over the 12 data values, in DOCUMENT order, comments excluded
   A80EA7F656DC17A7D947D8A6EC0706E47684363E9FCF68CBC1F50951B2721509…
sops_mac plaintext
   A80EA7F656DC17A7D947D8A6EC0706E47684363E9FCF68CBC1F50951B2721509…      MATCH
```

Three properties in one measurement: comments are **not** in the digest (ADR
0041's rule, confirmed in a third format), an unencrypted leaf contributes the
literal text of its line, and an empty value contributes the empty string.

### 3. The AAD of a comment: `:`, and nothing else

This is the measurement that decides the tree shape. Each comment leaf was
decrypted against a list of candidate AADs: