[tammy-baylis-swi]

Implements a Copilot suggestion:

• Hardened signature verification: trace-option signatures could use hmac.compare_digest instead of ordinary equality, and malformed/non-ASCII signatures should be rejected as bad signatures.

[Copilot]

🟡 Changes recommended

The tests leave malformed, non-ASCII, and invalid-type signature rejection unverified because the success-only mock bypasses the real comparator and would not catch a missing exception handler.

1 open issue

• Test malformed and non-ASCII signature rejection · New

What changed in this PR

This PR hardens x-trace-options signature verification in the SolarWinds APM distribution.

Changes:

• Replaces ordinary equality with hmac.compare_digest.
• Returns Auth.BAD_SIGNATURE when comparison rejects malformed or non-ASCII signatures.
• Adds a unit test verifying that signature validation calls the constant-time comparator.

File	Description
tests/​unit/​test_oboe/​test_trace_options.py	Adds a mocked test for comparator usage.
solarwinds_apm/​oboe/​trace_options.py	Uses constant-time comparison and handles invalid signatures.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the signature-verification hardening change.

No open issues 🎉

1 resolved since last review

• Test malformed and non-ASCII signature rejection

_{Review effort: Balanced}