artifact filename mangling might break valid unix file paths

[lukpueh]

[based on X41 source code audit informational note]

in_toto.runlib.record_artifacts_as_dict mangles file names to provide consistency between different operating systems. But replacing a backslash with a slash, can break valid Unix file paths:

in-toto/in_toto/runlib.py

Lines 260 to 263 in fe5ec9a

	# FIXME: this is necessary to provide consisency between windows
	# filepaths and *nix filepaths. A better solution may be in order
	# though...
	artifact = artifact.replace('\\', '/')

Solution Advice

X41 recommends to normalize file paths by d by using file:// URLs that are handled the same on all supported operating systems.

ITE-4 defines the necessary specification change, and #536 provides a implementation.