Publish Chimera GFX source

tools/build-firmware-probe.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+readonly allowed_firmware="9.60"
+readonly expected_sdk_commit="d2e2e585740362976a39fdd5ccf390f199a7bc37"
+readonly script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly root="$(cd "${script_dir}/.." && pwd)"
+readonly sdk="${PS5_PAYLOAD_SDK:-${root}/work/toolchains/ps5-payload-sdk-v0.41}"
+readonly sdk_source="${CHIMERA_GFX_SDK_SOURCE:-${root}/work/upstream/sdk}"
+readonly build="${root}/build/probe-9.60"
+readonly outputs="${root}/outputs"
+readonly artifact_name="chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf"
+readonly manifest_name="chimera-gfx-capability-probe-0.1.0-fw-9.60.json"
+
+if [[ "${1:-}" != "${allowed_firmware}" || $# -ne 1 ]]; then
+  echo "usage: $0 9.60" >&2
+  exit 64
+fi
+if [[ ! -f "${sdk}/toolchain/prospero.cmake" ||
+      ! -x "${sdk}/bin/prospero-nm" ]]; then
+  echo "missing verified PS5 Payload SDK v0.41 toolchain" >&2
+  exit 2
+fi
+if ! command -v llvm-readelf-18 >/dev/null 2>&1; then
+  echo "missing llvm-readelf-18 for the strict dynamic-table audit" >&2
+  exit 2
+fi
+if [[ ! -d "${sdk_source}/.git" ||
+      "$(git -C "${sdk_source}" rev-parse HEAD)" != "${expected_sdk_commit}" ]]; then
+  echo "SDK source checkout is not at the locked v0.41 commit" >&2
+  exit 2
+fi
+if ! git -C "${root}" diff --quiet ||
+   ! git -C "${root}" diff --cached --quiet; then
+  echo "refusing provenance build from a dirty project tree" >&2
+  exit 2
+fi
+
+mkdir -p "${build}" "${outputs}"
+python3 "${root}/tools/audit_ps5_sdk_runtime.py" \
+  --sdk-source "${sdk_source}" \
+  --project-root "${root}" \
+  --output "${build}/sdk-runtime-audit.json"
+
+export LLVM_CONFIG="${LLVM_CONFIG:-/usr/bin/llvm-config-18}"
+cmake -S "${root}" -B "${build}" -G Ninja \
+  -DCMAKE_TOOLCHAIN_FILE="${sdk}/toolchain/prospero.cmake" \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DBUILD_TESTING=OFF \
+  -DCHIMERA_GFX_BUILD_PS5_PROBE=ON \
+  -DCHIMERA_GFX_BUILD_PHASE1_VIDEOOUT_CLEAR=OFF \
+  -DCHIMERA_GFX_PS5_ALLOWED_FIRMWARE="${allowed_firmware}"
+cmake --build "${build}" --clean-first \
+  --target chimera-gfx-capability-probe
+
+cmake -E copy_if_different \
+  "${build}/chimera-gfx-capability-probe.elf" \
+  "${outputs}/${artifact_name}"
+cmake -E copy_if_different \
+  "${build}/sdk-runtime-audit.json" \
+  "${outputs}/sdk-runtime-audit-v0.41.json"
+
+python3 "${root}/tools/audit_ps5_artifacts.py" \
+  --nm "${sdk}/bin/prospero-nm" \
+  --readelf "$(command -v llvm-readelf-18)" \
+  --probe "${outputs}/${artifact_name}" \
+  --symbol-manifest "${root}/manifests/ps5_gnm_symbols.json" \
+  --firmware "${allowed_firmware}"
+
+readonly source_commit="$(git -C "${root}" rev-parse HEAD)"
+python3 "${root}/tools/generate_artifact_manifest.py" \
+  --artifact "${outputs}/${artifact_name}" \
+  --output "${outputs}/${manifest_name}" \
+  --id "chimera-gfx-capability-probe-fw-9.60" \
+  --version "0.1.0" \
+  --source-repository \
+    "https://gitea.itworx.tech/Jens/chimera-gfx.git" \
+  --source-commit "${source_commit}" \
+  --target "ps5-x86_64" \
+  --firmware "${allowed_firmware}" \
+  --profile "symbol-discovery-only-offline-audit" \
+  --note "Transfer and execution are not authorized." \
+  --note "Project code calls no resolved GNM symbol and requests no rendering or GPU mutation." \
+  --note "SDK v0.41 CRT performs kernel credential and syscall-permission writes before main; execution is blocked by project policy."
+python3 "${root}/tools/verify_artifact_manifest.py" \
+  --manifest "${outputs}/${manifest_name}" \
+  --artifact "${outputs}/${artifact_name}"
+
+echo "Built and audited offline only: ${outputs}/${artifact_name}"
+echo "Execution eligibility: false; do not transfer or execute this ELF."