Meaning of [0000:10000] in a byte sequence

[adamfarquhar]

There are a small number of signatures in Pronom v119 (e.g., fmt/899, fmt/900, fmt/1795) that includes [0000:1000]. Normally, the square brackets match a single byte within an inclusive range where the byte values are hex encoded. For example, [00:AF] should match bytes with decimal values 0 through 175.

Can someone clarify what [0000:1000] means? Is it a signature typo? Or is it a four byte pattern for 32-bit integers from 0 through 4096? Or does it mean something else?

If it meant four bytes representing numbers x0000 through x10000, then we could write this as [0:1]??? - the first byte is either a zero or 1, then the remaining three bytes can have any value.

@ross-spencer - You may have contributed this signature, so are likely to know the answer!

[richardlehane]

Hi @adamfarquhar

these multibyte ranges are unusual but are in the PRONOM/DROID spec (https://www.nationalarchives.gov.uk/aboutapps/fileformat/pdf/automatic_format_identification.pdf):

I.e. you don't interpret 0000 or 1000 as multi-byte types (16-bit integers) but as two byte sequences "0x00 0x00" and "0x10 0x00" and you compare those sequences lexicographically.

You can see my implementation for siegfried here: https://github.com/richardlehane/siegfried/blob/5e86c0355bcf30bc74e75bc3c4d3ee8a3be35ab8/pkg/pronom/patterns.go#L37

Fortunately golang's bytes package has a Compare function (https://pkg.go.dev/bytes#Compare) which does lexicographical comparison, so I didn't have to think about it to deeply, but I believe it means:

• if the first byte is less than 0x10, then the second byte can be anything
• if the first byte is 0x10, then the second byte must be 0x00, or it won't match
• if the first byte is over 0x10, it won't match