111 lines
4.8 KiB
Python
111 lines
4.8 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Validate the fail-closed Phase-0.8 preflight record."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
|
|
|
|
def load(path: Path) -> dict[str, object]:
|
|
document = json.loads(path.read_text(encoding="utf-8"))
|
|
if not isinstance(document, dict):
|
|
raise RuntimeError(f"{path}: expected an object")
|
|
return document
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
root = args.root.resolve()
|
|
|
|
audit = load(root / "manifests/runtime/phase-0.8-read-only-preflight.json")
|
|
profile = load(root / "manifests/runtime/controlled-ps5-runtime-profile.json")
|
|
locks = load(root / "manifests/upstreams.lock.json")
|
|
|
|
if audit.get("decision") != "READ_ONLY_PREFLIGHT_BLOCKED":
|
|
raise RuntimeError("Phase-0.8 no longer fails closed")
|
|
if audit.get("scope") != "offline_admissibility_audit_only":
|
|
raise RuntimeError("Phase-0.8 scope was widened")
|
|
if audit.get("on_device_session_started") is not False:
|
|
raise RuntimeError("Phase-0.8 incorrectly claims an on-device session")
|
|
if audit.get("dataset_complete") is not False:
|
|
raise RuntimeError("Phase-0.8 incorrectly claims a complete dataset")
|
|
if audit.get("open_stop_ro") is not True or audit.get("open_stop_gate") is not True:
|
|
raise RuntimeError("Phase-0.8 stop state is incomplete")
|
|
|
|
authorization = audit["authorization"]
|
|
false_authorizations = (
|
|
"explicit_read_only_preflight_permission_recorded",
|
|
"connection_authorized",
|
|
"installation_authorized",
|
|
"lifecycle_authorized",
|
|
"execution_authorized",
|
|
"automatic_retry",
|
|
)
|
|
if any(authorization[key] is not False for key in false_authorizations):
|
|
raise RuntimeError("Phase-0.8 records unauthorized authority")
|
|
if (
|
|
authorization["permission_reference"] is not None
|
|
or authorization["permission_exact_text"] is not None
|
|
):
|
|
raise RuntimeError("Phase-0.8 invents a permission record")
|
|
|
|
if any(audit["ps5_actions"].values()):
|
|
raise RuntimeError("Phase-0.8 records an on-device action")
|
|
|
|
collector = audit["collector_assessment"]
|
|
if collector["selected_collector"] is not None:
|
|
raise RuntimeError("Phase-0.8 selected an inadmissible collector")
|
|
if collector["can_prove_no_atime_audit_cache_or_metadata_change"] is not False:
|
|
raise RuntimeError("Phase-0.8 overstates collector side-effect proof")
|
|
candidates = {item["id"]: item for item in collector["candidates"]}
|
|
payload_manager = candidates["payload_manager_v0_3_1_http"]
|
|
if payload_manager["usable"] is not False or payload_manager["result"] != "STOP-RO":
|
|
raise RuntimeError("stock Payload Manager HTTP was promoted")
|
|
|
|
manager_lock = locks["sources"]["ps5_payload_manager"]
|
|
if payload_manager["source_commit"] != manager_lock["commit"]:
|
|
raise RuntimeError("Payload Manager preflight source is not pinned")
|
|
|
|
required_blockers = {
|
|
"explicit_permission_record_absent": "STOP-RO",
|
|
"collector_side_effect_freedom_unproven": "STOP-RO",
|
|
"payload_manager_http_mutates_runtime_state": "STOP-RO",
|
|
"two_source_firmware_attestation_absent": "STOP-GATE",
|
|
"current_live_identity_and_topology_absent": "STOP-GATE",
|
|
"autoload_startup_retry_state_absent": "STOP-GATE",
|
|
"stock_elfldr_backup_unproven": "STOP-GATE",
|
|
"stock_payload_manager_backup_unproven": "HARD_STOP-GATE",
|
|
}
|
|
blockers = {item["id"]: item["severity"] for item in audit["blockers"]}
|
|
if blockers != required_blockers:
|
|
raise RuntimeError("Phase-0.8 blocker set changed")
|
|
|
|
if audit["firmware"]["two_current_sources_agree"] != "UNPROVEN":
|
|
raise RuntimeError("Phase-0.8 invents a second firmware source")
|
|
if (
|
|
audit["rollback_preconditions"]["stock_payload_manager_backup"]["result"]
|
|
!= "HARD_STOP-GATE"
|
|
):
|
|
raise RuntimeError("Payload Manager rollback hard gate disappeared")
|
|
if audit["payload_manager_backup_exactly_present"] != "UNPROVEN":
|
|
raise RuntimeError("Phase-0.8 invents an exact manager backup")
|
|
if audit["historical_evidence_is_not_current_preflight_evidence"] is not True:
|
|
raise RuntimeError("historical observations were promoted to current evidence")
|
|
|
|
if profile["deployment"]["installed"] is not False:
|
|
raise RuntimeError("Phase-0.8 incorrectly marks the hardened runtime installed")
|
|
if profile["execution_authorized"] is not False:
|
|
raise RuntimeError("Phase-0.8 widened execution authority")
|
|
|
|
print("Phase-0.8 read-only preflight remains blocked without PS5 contact")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|