Single object top-level rule: still needed?

[bumblefudge]

Original DAG-CBOR spec:

Encode and decode must operate on a single top-level CBOR object. Back-to-back concatenated objects are not allowed or supported, as suggested by section 5.1 of RFC 8949 for streaming applications. All bytes of an encoded DAG-CBOR object must decode to a single object. Extraneous bytes included in an IPLD block, whether valid or invalid CBOR, must not be accepted as valid DAG-CBOR.

I remember seeing an issue about ATProto's usage of DAG-CBOR breaking this rule, and am wondering if there is some "decode-only" style tolerance that could happen here, or if this is an issue i've misunderstood from the jump.

[bumblefudge]

Also note: copying this section over from Rundgren's CBOR/c draft might simplify or complicate this issue; however this "single object only" rule is decided, we should remember to update this section accordingly.

[vmx]

I think forbidding trailing bytes (which multiple objects would be) was a security consideration. Though I don't recall details. But I can ask around if it matters.