fix(net): validate decoded peer IDs

[burak33bb]

Summary

AddressInfoFromString now parses the serialized peer ID with libp2p's peer.Decode instead of decoding the string as raw base58 bytes and casting the result to peer.ID.

That keeps the JSON round trip behavior the same for valid peer.AddrInfo values, while rejecting malformed peer IDs such as an empty peerID field.

Changes

• use peer.Decode when rebuilding peer.AddrInfo
• add regression coverage for an empty serialized peer ID
• retain mr-tron/base58 as an indirect dependency of libp2p

Summary by CodeRabbit

• Bug Fixes

  • Improved peer ID parsing when processing network addresses.
  • Empty or malformed peer IDs are now rejected with a clear parsing error.
  • Network address information now preserves decoded peer identities more reliably.

• Tests

  • Added regression coverage to verify that empty peer IDs are rejected.
  • Updated address round-trip coverage for typed peer IDs.

Current validation (October 7, 2026)

Updated with main 545fc100175001b5266175184f9051b606e1fc04 without conflicts. On Go 1.26.6 / Linux, go test -race -count=1 ./pkg/net ./pkg/identity, go vet ./pkg/net ./pkg/identity, and git diff --check passed. Full repository CI requires maintainer approval.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: getoptimum/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7e642d5d-2f1d-4aaf-aab9-d5a7af5a945a

📥 Commits

Reviewing files that changed from the base of the PR and between 2aced99 and 2394425.

📒 Files selected for processing (1)

• pkg/net/multiaddrutil_test.go

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

AddressInfoFromString now parses serialized peer IDs with peer.Decode and assigns the decoded peer.ID directly. The unused base58 import was removed. Tests cover valid address round trips and rejection of an empty peerID.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: abergasov, hpsing, swarna1101

Merge Risk: ⚪ Minimal · up to 23944

The PR validates serialized peer IDs while preserving valid address round trips and adds coverage for malformed input; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 8 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Scope Discipline	✅ Passed	PASS. The PR changes only go.mod, pkg/net/multiaddrutil.go, and its test file. The implementation change directly supports the stated peer-ID parsing goal. The test updates add focused regression …
Behavior Safety	✅ Passed	PASS: The behavior change is explicit and intentional. AddressInfoFromString now uses peer.Decode, returns a wrapped error when parsing fails, and assigns the validated peer.ID. The round-trip t…
Over-Engineering	✅ Passed	The change does not introduce an unnecessary cache, helper layer, or signature churn. It replaces direct base58 decoding with the existing peer.Decode API and removes the unused direct dependency. T…
Security	✅ Passed	PASS. The diff replaces raw base58 byte casting with peer.Decode, which adds peer-ID validation and rejects empty or malformed IDs. The change adds no credentials, secrets, cryptographic weakening, …
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows the required format, uses the allowed type and domain, and summarizes peer ID validation.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[JspIIV]

Heads up on the red CI, in case it saves you some digging.

mr-tron/base58 is still needed indirectly. libp2p/go-libp2p/core/peer imports it, so dropping the require line entirely leaves go.sum an entry short and every Go job fails on the same thing:

missing go.sum entry for module providing package github.com/mr-tron/base58/base58
  (imported by github.com/libp2p/go-libp2p/core/peer)

go mod tidy should sort it: it moves the module into the // indirect block rather than removing it, and updates go.sum to match.

Nice catch on the underlying bug, by the way. Casting raw base58 bytes to peer.ID skipping validation is easy to miss, and fixing the test that was building an invalid peer.ID from the display form is a good spot too.

[burak33bb]

All CI checks are green and CodeRabbit reports no actionable issues / minimal merge risk. This should be ready for review when you get a chance. @hpsing @abergasov @swarna1101

[burak33bb]

Updated the PR branch with current main (545fc100175001b5266175184f9051b606e1fc04) without conflicts. The peer-ID validation fix and indirect mr-tron/base58 dependency are preserved; the PR diff remains three focused files.

Validation on Go 1.26.6 / Linux:

• go test -race -count=1 ./pkg/net ./pkg/identity: passed.
• go vet ./pkg/net ./pkg/identity: passed.
• git diff --check: passed.

Could a maintainer approve the workflows for the updated head and review when convenient? The previous revision's Lint, Tests and Security Scanning runs were waiting for approval; those are not passing results for this new revision.