142 lines
5.4 KiB
Python
142 lines
5.4 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Mutation guardrails for the Phase-1.0P offline analysis."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import copy
|
|
import importlib.util
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
|
|
def load(path: Path):
|
|
spec = importlib.util.spec_from_file_location("phase10p", path)
|
|
assert spec and spec.loader
|
|
module = importlib.util.module_from_spec(spec)
|
|
sys.modules[spec.name] = module
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def require(value: bool, message: str) -> None:
|
|
if not value:
|
|
raise RuntimeError(message)
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
root = args.root.resolve()
|
|
validator = load(root / "tools/validate_retroarch_phase10p.py")
|
|
record = validator.load_json(
|
|
root / "manifests/retroarch/phase-1.0p-videoout-submit-analysis.json")
|
|
cases = []
|
|
|
|
def case(name):
|
|
def register(function):
|
|
cases.append((name, function))
|
|
return function
|
|
return register
|
|
|
|
@case("01 all authorizations are false")
|
|
def _(): require(validator.all_false(record["current_authorizations"], validator.AUTHORIZATION_FIELDS), "authority active")
|
|
|
|
@case("02 execution authorization fails")
|
|
def _():
|
|
value = dict(record["current_authorizations"]); value["device_execution_authorized"] = True
|
|
require(not validator.all_false(value, validator.AUTHORIZATION_FIELDS), "execution authority accepted")
|
|
|
|
@case("03 automatic retry fails")
|
|
def _():
|
|
value = dict(record["current_authorizations"]); value["automatic_retry"] = True
|
|
require(not validator.all_false(value, validator.AUTHORIZATION_FIELDS), "retry accepted")
|
|
|
|
@case("04 bound inputs are exact")
|
|
def _(): require(validator.bound_inputs_are_exact(record["bound_inputs"]), "bound inputs rejected")
|
|
|
|
@case("05 artifact hash mutation fails")
|
|
def _():
|
|
value = dict(record["bound_inputs"]); value["artifact_sha256"] = "0" * 64
|
|
require(not validator.bound_inputs_are_exact(value), "wrong artifact accepted")
|
|
|
|
@case("06 trace hash mutation fails")
|
|
def _():
|
|
value = dict(record["bound_inputs"]); value["trace_sha256"] = "0" * 64
|
|
require(not validator.bound_inputs_are_exact(value), "wrong trace accepted")
|
|
|
|
@case("07 exact call is bounded")
|
|
def _(): require(validator.exact_call_is_bounded(record["exact_call"]), "call rejected")
|
|
|
|
@case("08 guessed buffer index fails")
|
|
def _():
|
|
value = copy.deepcopy(record["exact_call"]); value["registers"]["esi"] = 1
|
|
require(not validator.exact_call_is_bounded(value), "guessed index accepted")
|
|
|
|
@case("09 invented successful submit fails")
|
|
def _():
|
|
value = dict(record["exact_call"]); value["runtime_return"] = 0
|
|
require(not validator.exact_call_is_bounded(value), "success invented")
|
|
|
|
@case("10 invented errno fails")
|
|
def _():
|
|
value = dict(record["exact_call"]); value["saved_errno"] = 22
|
|
require(not validator.exact_call_is_bounded(value), "errno invented")
|
|
|
|
@case("11 ABI claims fail closed")
|
|
def _(): require(validator.abi_claims_fail_closed(record["abi_evidence"]), "ABI record rejected")
|
|
|
|
@case("12 semantic promotion fails")
|
|
def _():
|
|
value = dict(record["abi_evidence"]); value["flip_mode_semantics"] = "PROVEN"
|
|
require(not validator.abi_claims_fail_closed(value), "mode promoted")
|
|
|
|
@case("13 symbol is not ABI evidence")
|
|
def _(): require(record["decision"]["new_videoout_export_call_allowed"] is False, "new call allowed")
|
|
|
|
@case("14 frame mismatch is rejected only as current cause")
|
|
def _(): require(record["candidate_matrix"]["diagnostic_normal_first_index_mismatch"] == "REJECTED_CURRENT_CAUSE", "candidate overclaim")
|
|
|
|
@case("15 terminal ordering is preserved")
|
|
def _(): require(validator.terminal_order_is_not_promoted(record["terminal_ordering"]), "order rejected")
|
|
|
|
@case("16 D12 cleanup promotion fails")
|
|
def _():
|
|
value = dict(record["terminal_ordering"]); value["d12_proves_cleanup_complete"] = True
|
|
require(not validator.terminal_order_is_not_promoted(value), "cleanup invented")
|
|
|
|
@case("17 parser relaxation fails")
|
|
def _():
|
|
value = dict(record["terminal_ordering"]); value["host_parser_relaxation_allowed"] = True
|
|
require(not validator.terminal_order_is_not_promoted(value), "parser relaxation accepted")
|
|
|
|
@case("18 decision is fail closed")
|
|
def _(): require(validator.decision_is_fail_closed(record["decision"]), "decision rejected")
|
|
|
|
@case("19 parameter experiment fails")
|
|
def _():
|
|
value = dict(record["decision"]); value["parameter_experiment_allowed"] = True
|
|
require(not validator.decision_is_fail_closed(value), "experiment allowed")
|
|
|
|
@case("20 host analysis is not device evidence")
|
|
def _(): require(record["tests"]["hardware_claim_from_host_test"] is False, "host test promoted")
|
|
|
|
failures = []
|
|
for name, function in cases:
|
|
try:
|
|
function()
|
|
print(f"PASS {name}")
|
|
except Exception as error: # noqa: BLE001 - mutation harness
|
|
failures.append(f"{name}: {error}")
|
|
print(f"FAIL {name}: {error}")
|
|
if failures:
|
|
return 1
|
|
print(f"Phase-1.0P guardrails passed: {len(cases)}")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|