Publish Chimera GFX source

tools/phase10dc_bigapp_gate_contract.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Pure, inactive Phase-1.0DC BigApp comparison-gate contract."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import re
+
+
+PHASE = "PHASE_1_0DC_INACTIVE_BIGAPP_COMPARISON_GATE"
+FIRMWARE = "9.60"
+TITLE_ID = "PPSA01659"
+PAYLOAD_NAME = "retroarch_ps5_launch_canary.elf"
+PAYLOAD_SIZE = 1845240
+PAYLOAD_SHA256 = "8dadce9d9faaef21ea129a3d216c768eea9a3ca9bf8ecb8d852e376b58a9bf95"
+PROTOCOL_MAGIC = "CHD10AV1"
+PROTOCOL_TERMINAL = "D14"
+MAX_WINDOW_SECONDS = 300
+SHA256 = re.compile(r"^[0-9a-f]{64}$")
+RUN_ID = re.compile(r"^[A-Z0-9][A-Z0-9_-]{7,63}$")
+
+
+class BigAppGateError(ValueError):
+    """Candidate data is incomplete, ambiguous, or unsafe."""
+
+
+@dataclass(frozen=True)
+class BigAppGateRecord:
+    phase: str
+    active: bool
+    firmware: str | None
+    title_id: str | None
+    run_id: str | None
+    not_before: str | None
+    expires_at: str | None
+    launcher_name: str | None
+    launcher_size: int | None
+    launcher_sha256: str | None
+    payload_name: str | None
+    payload_size: int | None
+    payload_sha256: str | None
+    approval_sha256: str | None
+    result_magic: str | None
+    result_terminal: str | None
+    no_running_bigapp_attested: bool
+    kernel_ptrace_effects_accepted: bool
+    app_termination_authorized: bool
+    persistent_write_authorized: bool
+    system_remount_authorized: bool
+    installation_authorized: bool
+    autoload_authorized: bool
+    automatic_retry: bool
+    reconnect: bool
+    fallback_title: bool
+    bounded_parent_detach_proven: bool
+    bounded_child_cleanup_proven: bool
+    bounded_result_channel_proven: bool
+
+
+def _utc(value: str | None) -> datetime:
+    if not isinstance(value, str) or not value.endswith("Z"):
+        raise BigAppGateError("timestamp must be exact UTC")
+    try:
+        result = datetime.fromisoformat(value[:-1] + "+00:00")
+    except ValueError as error:
+        raise BigAppGateError("timestamp is invalid") from error
+    if result.tzinfo != timezone.utc:
+        raise BigAppGateError("timestamp is not UTC")
+    return result
+
+
+def validate_inactive(record: BigAppGateRecord) -> None:
+    """Require the tracked record to contain no live identity or authority."""
+    if type(record) is not BigAppGateRecord or record.phase != PHASE or record.active:
+        raise BigAppGateError("tracked gate is not inert")
+    identities = (
+        record.firmware, record.title_id, record.run_id, record.not_before,
+        record.expires_at, record.launcher_name, record.launcher_size,
+        record.launcher_sha256, record.payload_name, record.payload_size,
+        record.payload_sha256, record.approval_sha256, record.result_magic,
+        record.result_terminal,
+    )
+    if any(value is not None for value in identities):
+        raise BigAppGateError("inactive gate contains an identity")
+    if any((record.no_running_bigapp_attested,
+            record.kernel_ptrace_effects_accepted,
+            record.app_termination_authorized,
+            record.persistent_write_authorized,
+            record.system_remount_authorized,
+            record.installation_authorized, record.autoload_authorized,
+            record.automatic_retry, record.reconnect, record.fallback_title,
+            record.bounded_parent_detach_proven,
+            record.bounded_child_cleanup_proven,
+            record.bounded_result_channel_proven)):
+        raise BigAppGateError("inactive gate contains authority or proof")
+
+
+def validate_candidate(record: BigAppGateRecord) -> None:
+    """Validate hypothetical data; this function grants no authorization."""
+    if type(record) is not BigAppGateRecord or record.phase != PHASE or not record.active:
+        raise BigAppGateError("candidate is not explicitly active")
+    if record.firmware != FIRMWARE or record.title_id != TITLE_ID:
+        raise BigAppGateError("firmware or fixed title mismatch")
+    if not isinstance(record.run_id, str) or not RUN_ID.fullmatch(record.run_id):
+        raise BigAppGateError("run identity is invalid")
+    start, end = _utc(record.not_before), _utc(record.expires_at)
+    if not 0 < (end - start).total_seconds() <= MAX_WINDOW_SECONDS:
+        raise BigAppGateError("activation window is invalid")
+    if record.launcher_name != "chimera_bigapp_canary_launcher.elf" or \
+            not isinstance(record.launcher_size, int) or isinstance(record.launcher_size, bool) or \
+            not 1 <= record.launcher_size <= 1048576 or \
+            not isinstance(record.launcher_sha256, str) or not SHA256.fullmatch(record.launcher_sha256):
+        raise BigAppGateError("launcher identity is invalid")
+    if (record.payload_name, record.payload_size, record.payload_sha256) != \
+            (PAYLOAD_NAME, PAYLOAD_SIZE, PAYLOAD_SHA256):
+        raise BigAppGateError("payload identity is not the unchanged CZ artifact")
+    if not isinstance(record.approval_sha256, str) or not SHA256.fullmatch(record.approval_sha256):
+        raise BigAppGateError("separate approval identity is invalid")
+    if (record.result_magic, record.result_terminal) != \
+            (PROTOCOL_MAGIC, PROTOCOL_TERMINAL):
+        raise BigAppGateError("result protocol is invalid")
+    required = (record.no_running_bigapp_attested,
+                record.kernel_ptrace_effects_accepted,
+                record.bounded_parent_detach_proven,
+                record.bounded_child_cleanup_proven,
+                record.bounded_result_channel_proven)
+    if any(value is not True for value in required):
+        raise BigAppGateError("required attestation or bounded proof is absent")
+    forbidden = (record.app_termination_authorized,
+                 record.persistent_write_authorized,
+                 record.system_remount_authorized,
+                 record.installation_authorized, record.autoload_authorized,
+                 record.automatic_retry, record.reconnect,
+                 record.fallback_title)
+    if any(value is not False for value in forbidden):
+        raise BigAppGateError("candidate permits a forbidden effect")