Repository navigation
Pin the Public Suffix List snapshot used for eTLD+1 #1562
Description
Problem
tldextract>=5.1.0 (pyproject.toml) bundles a PSL snapshot that varies by installed version; etld.py already disables runtime fetches (suffix_list_urls=()), so only the version varies.
The spec requires "a pinned, dated Public Suffix List snapshot", and says "two verifiers running different PSL versions are non-conformant against each other" (security.mdx, R3a). This affects trust.json derivation, the grant rule that a grantee must be a registrable domain, and RFC 9421 origin binding.
Fix
Pin tldextract exactly or, better, load the spec's reference public_suffix_list.dat via a local suffix list, expose its date and hash, and add eTLD+1 tests from the spec's vectors. Raised by Konstantin on #1542.
Depends on the spec naming the reference snapshot: adcontextprotocol/adcp#8409
🤖 Generated with Claude Code
Activity
bokelley commentedon Oct 27, 2026
#1652 implements the mechanism. The SDK vendors
signing/_psl/public_suffix_list.dat, reads only that file (no tldextract bundled list, no cache, no network), checks it against a recorded SHA-256, and exposesadcp.signing.PSL_SNAPSHOT(version, commit, sha256). The vendored list is the one tldextract 5.4.0 bundles (publicsuffix.org2025-04-07_15-51-09_UTC, commit5fc8d12c), so no results change.Still blocked: adcontextprotocol/adcp#8409 hasn't named the reference snapshot, and there's a counter-proposal there to drop the cross-verifier requirement. Once it's resolved, this issue needs either a swap to the named snapshot plus the spec's eTLD+1 vectors, or closing as not needed.
feat(signing): pin the Public Suffix List snapshot used for eTLD+1 (#…
bokelley commentedon Nov 6, 2026
Closing without code changes. adcontextprotocol/adcp#8702 (DR-0037) resolved adcp#8409 the other way: AdCP names no PSL snapshot. A verifier bundles a list with the ICANN and PRIVATE sections, never fetches it at runtime, and SHOULD keep it current through normal dependency updates. Different lists across verifiers are no longer non-conformant. The SDK's existing bundled list already meets this, so keeping that dependency current is enough.