Publish Chimera GFX source

tools/validate_retroarch_phase10ah.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Validate Phase-1.0AH identities and official source bindings."""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+
+
+def digest(path: Path) -> tuple[int, str]:
+    data = path.read_bytes()
+    return len(data), hashlib.sha256(data).hexdigest()
+
+
+def git(root: Path) -> str:
+    return subprocess.run(["git", "-C", str(root), "rev-parse", "HEAD"],
+                          check=True, capture_output=True, text=True).stdout.strip()
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--root", type=Path, required=True)
+    parser.add_argument("--shsrv-v07-root", type=Path, required=True)
+    parser.add_argument("--sdk-root", type=Path, required=True)
+    args = parser.parse_args()
+    data = json.loads((args.root / "manifests/retroarch/phase-1.0ah-dynamic-contract.json").read_text(encoding="utf-8"))
+    bindings = data["source_bindings"]
+    assert hashlib.sha256((args.root / "manifests/retroarch/phase-1.0ag-bounded-elf-contract.json").read_bytes()).hexdigest() == bindings["phase10ag_manifest_sha256"]
+    for prefix, relative in (("contract", "tools/phase10ah_dynamic_contract.py"),
+                             ("tests", "tests/test_phase10ah_dynamic_contract.py")):
+        size, sha256 = digest(args.root / relative)
+        assert size == bindings[f"{prefix}_size"] and sha256 == bindings[f"{prefix}_sha256"]
+    assert git(args.shsrv_v07_root) == bindings["official_shsrv_v07_commit"]
+    assert digest(args.shsrv_v07_root / "elfldr.c")[1] == bindings["official_shsrv_v07_elfldr_sha256"]
+    assert git(args.sdk_root) == bindings["official_sdk_v041_commit"]
+    assert digest(args.sdk_root / "crt/rtld_payload.c")[1] == bindings["official_sdk_v041_rtld_payload_sha256"]
+    tree = ast.parse((args.root / "tools/phase10ah_dynamic_contract.py").read_text(encoding="utf-8"))
+    imports = {alias.name.split(".")[0] for node in ast.walk(tree)
+               if isinstance(node, ast.Import) for alias in node.names}
+    imports.update(node.module.split(".")[0] for node in ast.walk(tree)
+                   if isinstance(node, ast.ImportFrom) and node.module)
+    assert not imports.intersection({"pathlib", "os", "sys", "subprocess", "socket", "ctypes", "mmap"})
+    assert not any(data["authorizations"].values())
+    assert data["historical_phase10m_reference"]["validated_by_phase10ah"] is False
+    assert data["decision"]["target_mapping_allowed"] is False
+    assert data["decision"]["device_action_allowed"] is False
+    print("Phase-1.0AH dynamic contract validation passed")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())