## Chapter 7 — One key is not a clean verdict ### Lesson map Lesson 07. Map, example, EX053. ```mermaid flowchart TD K["One digest in known_bad"] --> G{"Is the full digest that key?"} G -->|Yes| L["Fake-template adware (synthetic)"] G -->|No| D["the string no match"] D --> Q{"Does no match mean safe?"} Q -->|No| S["It means absent from this dict"] ``` The default string is an absence. It is not a clearance. ### Logical drawing ```text known_bad one key, one label hit Fake-template adware (synthetic) miss no match list note known adware (list v1) a date is written in practice no calendar date is printed here ``` ### Learning outcomes After this chapter, you should be able to: 1. Count the keys in `known_bad`. 2. Read `no match` as the default string. 3. Refuse the word clean, and refuse a calendar date for list v1. ### 7.1 The default is what `.get` returns when the key is absent. `known_bad` is built with one entry. The key is the SHA-256 hex digest of `b"synthetic installer bytes - not a real program"`. The value is the label `Fake-template adware (synthetic)`. There is no second key, and there is no known-good dict beside it. `known_bad.get(h, 'no match')` returns the label when `h` is that key. Otherwise it returns the literal `no match`. The spreadsheet row and the photo row both take the default. They share a string because both digests are absent, not because the script compared the two files with each other. ISO/IEC 27042 separates what was observed from what someone concludes. The observation is "absent from this one-key dict". The conclusion "safe" is a different sentence, and the script does not print it. Priya's note uses "known adware (list v1)" for the hit. She also writes the date of the list she used. This book never prints that date, so a later page cannot invent one. NIST's National Software Reference Library is a collection of known software hashes, often used to set ordinary files aside. This lab did not query it. A miss against one synthetic key is not an NSRL "known" hit, and it is not a clearance. | Return | Meaning in this file | |---|---| | The adware label | Full digest equals the one key | | `no match` | Full digest is absent | | A date for list v1 | Written in practice, not printed here | | The word clean | Not a return value | ### 7.2 Worked example | Offered reading | What the file supports | Decision | |---|---|---| | The installer label is a hit on the one key | The digests are equal | Keep | | `no match` on two rows | Both keys were absent | Keep | | "`budget.xlsx` is clean." | The word is not in the output | Refuse | | "List v1 is dated 13 October." | No calendar date is printed | Refuse | > **Synthetic case.** The known-bad dict has one synthetic key. ### Errors and limits Do not promote a default string into a safety verdict. ### Apply - **EX053 — Default string.** `budget.xlsx` and `photo.jpg` print `no match`. Does that word mean the file is safe, and is a calendar date for list v1 available to copy? *Rubric:* 3 = no; `no match` means absent from the one-key dict; the installer label is the only hit; list v1 has no printed date;; 2 = the default is an absence and the date is unprinted;; 1 = one row;; 0 = none. ### Continue studying — lesson 07 (chapter 07 of 20) [← Chapter 06](#ch-06) · [Course chapter index](../SUBJECTS.md) · [Chapter 08 →](#ch-08) Continue to the next authored lesson. ## Worked answers **EX053.** No. `no match` means the full digest is absent from the one-key dict. The installer label is the only hit. List v1 has no printed date.