161 lines
7.0 KiB
Python
161 lines
7.0 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Validate the committed Phase-0.7 offline deployment evidence."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
|
|
|
|
def load(path: Path) -> dict[str, object]:
|
|
document = json.loads(path.read_text(encoding="utf-8"))
|
|
if not isinstance(document, dict):
|
|
raise RuntimeError(f"{path}: expected an object")
|
|
return document
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
root = args.root.resolve()
|
|
audit = load(root / "manifests/runtime/phase-0.7-offline-audit.json")
|
|
profile = load(root / "manifests/runtime/controlled-ps5-runtime-profile.json")
|
|
manifest = load(
|
|
root
|
|
/ "manifests/artifacts/chimera-gfx-lifecycle-probe-phase07-fw-9.60.json"
|
|
)
|
|
loader_manifest = load(
|
|
root / "manifests/artifacts/chimera-elfldr-phase07-fw-9.60.json"
|
|
)
|
|
manager_manifest = load(
|
|
root
|
|
/ "manifests/artifacts/chimera-payload-manager-phase07-fw-9.60.json"
|
|
)
|
|
proof = load(
|
|
root / "manifests/runtime/phase-0.7-kernelwrite-proof-matrix.json"
|
|
)
|
|
denylist = load(root / "manifests/artifact-denylist.json")
|
|
|
|
decision = "READY_FOR_HARDENED_RUNTIME_DEPLOYMENT"
|
|
if audit.get("decision") != decision or profile.get("decision") != decision:
|
|
raise RuntimeError("Phase-0.7 deployment decision is inconsistent")
|
|
if proof.get("decision") != decision:
|
|
raise RuntimeError("Phase-0.7 proof-matrix decision is inconsistent")
|
|
if proof.get("kernelwrite_free_claim") is not False:
|
|
raise RuntimeError("Phase-0.7 incorrectly claims kernelwrite-free startup")
|
|
if any(audit["ps5_actions"].values()):
|
|
raise RuntimeError("Phase-0.7 records a forbidden PS5 action")
|
|
if audit["firmware"] != "9.60":
|
|
raise RuntimeError("Phase-0.7 firmware gate changed")
|
|
|
|
lifecycle = audit["artifacts"]["lifecycle"]
|
|
if lifecycle["imports"] != ["_exit", "sceKernelSendNotificationRequest"]:
|
|
raise RuntimeError("lifecycle import inventory changed")
|
|
if lifecycle["dt_needed"] != [
|
|
"libSceLibcInternal.sprx",
|
|
"libkernel_web.sprx",
|
|
]:
|
|
raise RuntimeError("lifecycle DT_NEEDED inventory changed")
|
|
if lifecycle["byte_identical_clean_builds"] is not True:
|
|
raise RuntimeError("lifecycle reproducibility evidence is absent")
|
|
sensitive = lifecycle["sensitive_static_inventory"]
|
|
if sensitive["direct_call_reachability_available"] is not True:
|
|
raise RuntimeError("lifecycle direct reachability evidence is absent")
|
|
kernel_runtime = sensitive["categories"]["kernel_runtime_write"]
|
|
for required in (
|
|
"__patch_init",
|
|
"kernel_copyin",
|
|
"kernel_copyout",
|
|
"kernel_set_ucred_attrs",
|
|
"kernel_set_ucred_caps",
|
|
):
|
|
if required not in kernel_runtime["directly_reachable_from_entrypoint"]:
|
|
raise RuntimeError(f"lifecycle hides reachable CRT symbol {required}")
|
|
dynamic_loading = sensitive["categories"]["dynamic_loading"]["linked"]
|
|
for required in ("sceKernelLoadStartModule", "sceKernelStopUnloadModule"):
|
|
if required not in dynamic_loading:
|
|
raise RuntimeError(f"lifecycle hides linked rtld symbol {required}")
|
|
if sensitive["categories"]["graphics_or_display"]["linked"]:
|
|
raise RuntimeError("lifecycle links a graphics/display-sensitive symbol")
|
|
if lifecycle["sha256"] != manifest["artifact"]["sha256"]:
|
|
raise RuntimeError("lifecycle audit/manifest hash mismatch")
|
|
if lifecycle["size"] != manifest["artifact"]["size"]:
|
|
raise RuntimeError("lifecycle audit/manifest size mismatch")
|
|
loader = audit["artifacts"]["loader"]
|
|
if (
|
|
loader["sha256"] != loader_manifest["artifact"]["sha256"]
|
|
or loader["size"] != loader_manifest["artifact"]["size"]
|
|
):
|
|
raise RuntimeError("loader audit/manifest identity mismatch")
|
|
manager = audit["artifacts"]["manager"]
|
|
if (
|
|
manager["sha256"] != manager_manifest["artifact"]["sha256"]
|
|
or manager["size"] != manager_manifest["artifact"]["size"]
|
|
):
|
|
raise RuntimeError("manager audit/manifest identity mismatch")
|
|
for reviewed_manifest in (loader_manifest, manager_manifest, manifest):
|
|
if reviewed_manifest["execution"]["execution_eligible"] is not True:
|
|
raise RuntimeError("Phase-0.7 exact artifact is not statically eligible")
|
|
if any(
|
|
reviewed_manifest["execution"][key] is not False
|
|
for key in ("authorized", "transferred", "executed")
|
|
):
|
|
raise RuntimeError("Phase-0.7 manifest claims a forbidden action")
|
|
for stripped in (loader, manager):
|
|
inventory = stripped["sensitive_static_inventory"]
|
|
if inventory["direct_call_reachability_available"] is not False:
|
|
raise RuntimeError("stripped binary reachability is overstated")
|
|
if inventory["categories"]["graphics_or_display"]["linked"]:
|
|
raise RuntimeError("runtime links a graphics/display-sensitive symbol")
|
|
if manifest["execution"]["execution_eligible"] is not True:
|
|
raise RuntimeError("new lifecycle artifact is not statically eligible")
|
|
if any(
|
|
manifest["execution"][key] is not False
|
|
for key in ("authorized", "transferred", "executed")
|
|
):
|
|
raise RuntimeError("lifecycle manifest claims a forbidden action")
|
|
|
|
if profile["hard_blockers"]:
|
|
raise RuntimeError("Phase-0.7 profile still has hard blockers")
|
|
classifications = {
|
|
item["classification"] for item in profile["effects"]
|
|
}
|
|
if {"PERSISTENT_WRITE", "UNBOUNDED_OR_UNKNOWN"} & classifications:
|
|
raise RuntimeError("Phase-0.7 profile still has a hard effect")
|
|
if profile["firmware"]["evidence"] != "jens_explicitly_confirmed_exact_9.60":
|
|
raise RuntimeError("explicit firmware confirmation is absent")
|
|
if profile["deployment"] != {
|
|
"installed": False,
|
|
"ready_for_installation": True,
|
|
"rollback_prepared": True,
|
|
}:
|
|
raise RuntimeError("Phase-0.7 deployment state changed")
|
|
|
|
blocked = (
|
|
"4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63"
|
|
)
|
|
if [entry["sha256"] for entry in denylist["entries"]] != [blocked]:
|
|
raise RuntimeError("permanent denylist changed")
|
|
proof_status = {
|
|
item["component"]: item["status"] for item in proof["reviews"]
|
|
}
|
|
if proof_status.get("sdk_patch_init") != "UNSAFE":
|
|
raise RuntimeError("normal CRT process-local write is hidden")
|
|
if proof_status.get("firmware_9_60_runtime_behavior") != "UNPROVEN":
|
|
raise RuntimeError("offline audit claims hardware evidence")
|
|
if any(
|
|
proof["no_ps5_actions"][key] is not False
|
|
for key in ("connected", "installed", "transferred", "executed")
|
|
):
|
|
raise RuntimeError("proof matrix claims a forbidden PS5 action")
|
|
|
|
print("Phase-0.7 offline audit is deployment-ready and execution-unauthorized")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|