check / check (push) Waiting to run
A URL signed for path /a:b with no query must not verify for path /a with query b:, and the two must not share a cache key. New known-answer vectors pin the signature of a path with ":", a query with ":", and a "%" in path and query, with "%" written as "%25" and ":" as "%3A" in the signed data. These fail until the fix for #247 lands. Model: opus-5-5