From dfb130f5374c3e2b9650661ab85353820c5ce927 Mon Sep 17 00:00:00 2001
From: Christoph Fabianek <christoph@ownyourdata.eu>
Date: Mon, 26 Oct 2026 22:04:48 +0100
Subject: [PATCH] Build with DPP-CAR-002 v3; describe how the Nu Html Checker
 is updated

The image is built with the dpp-criteria commit in which the warning of
DPP-CAR-002 says that the GTIN carries the GS1 prefix 952 and the prefix is
also found in a GTIN-8. The integration test checks the wording of the
warning and a GTIN-8 padded to 14 digits.

The README says how often the digest of the Nu Html Checker is compared with
the latest release and how the checker is updated: new digest in the
manifest, the answers to the test vectors recorded again, the example
passports checked with the new checker.
---
 README.md                            | 24 ++++++++++++++++++++++++
 kubernetes/deployment.yaml           |  2 +-
 test/integration/validations_test.rb |  4 +++-
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index de7fae2..1b0abb3 100644
--- a/README.md
+++ b/README.md
@@ -217,6 +217,30 @@ into `kubernetes/deployment.yaml`. The changed manifest is committed and
 applied like any other change. `kubernetes/` is not part of the image, so
 writing the digest does not change the image.
 
+The Nu Html Checker in the manifest is version 26.10.12. Its digest is
+compared with the latest release once a month, and at once when a security
+notice concerns the checker or its image:
+
+```
+docker buildx imagetools inspect ghcr.io/validator/validator:latest
+```
+
+If the digest shown there differs from the one in `kubernetes/deployment.yaml`,
+the checker is updated in one pull request:
+
+1. Write the new digest into `kubernetes/deployment.yaml` and into
+   `test/fixtures/files/html/DPP-DAT-020/README.md`, and the new version into
+   both READMEs.
+2. Record the answers of the new checker to the test vectors again, as that
+   README describes, and run the test suite. Every file in `valid/` must still
+   have no error and every file in `invalid/` at least one; if a new rule of
+   the checker moves a vector, the pull request says which and why.
+3. Check the HTML views of the example passports with the new checker before
+   the manifest is applied.
+
+The dpplint image does not change for this; the manifest is applied like any
+other change.
+
 ## Tests
 
 ```
diff --git a/kubernetes/deployment.yaml b/kubernetes/deployment.yaml
index ca583ff..88c81e6 100644
--- a/kubernetes/deployment.yaml
+++ b/kubernetes/deployment.yaml
@@ -26,7 +26,7 @@ spec:
             app: dpplint
       containers:
       - name: dpplint
-        image: oydeu/dpplint@sha256:30f7b99950874ba357455baf42e68ad96968db9f65246e73f559300904f07414
+        image: oydeu/dpplint@sha256:721ff836b23f36b8ed9541732d07f49e7ebeec988f46e20b2ef987ce99572e94
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 3000
diff --git a/test/integration/validations_test.rb b/test/integration/validations_test.rb
index 25dbbaa..c5366fd 100644
--- a/test/integration/validations_test.rb
+++ b/test/integration/validations_test.rb
@@ -48,7 +48,9 @@ def criterion(result, id) = result["criteria"].find { |c| c["id"] == id }
     result = criterion(lint(reference), "DPP-CAR-002")
     assert_equal "warning", result["result"]
     assert_equal ["warning"], result["messages"].map { |m| m["severity"] }
-    assert_match(/GS1 prefix 952/, result["messages"].first["message"])
+    assert_match(/\AThe GTIN of the GS1 Digital Link carries the GS1 prefix 952,/, result["messages"].first["message"])
+    passport = reference.merge("uniqueProductIdentifier" => "https://dpp.example.org/01/00000095212340/21/000001")
+    assert_equal "warning", criterion(lint(passport), "DPP-CAR-002")["result"], "GTIN-8 with the GS1-8 prefix 952, padded to 14 digits"
   end
 
   test "GTIN with another prefix passes the product identifier scheme without a warning" do