49 lines
2.1 KiB
Python
49 lines
2.1 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Validate Phase-1.0AM bindings and capability-free boundary."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import ast
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
|
|
|
|
def digest(path: Path) -> tuple[int, str]:
|
|
data = path.read_bytes()
|
|
return len(data), hashlib.sha256(data).hexdigest()
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
root = parser.parse_args().root
|
|
data = json.loads((root / "manifests/retroarch/phase-1.0am-bounded-copy-model.json").read_text(encoding="utf-8"))
|
|
bindings = data["source_bindings"]
|
|
assert hashlib.sha256((root / "manifests/retroarch/phase-1.0al-mdbg-copy-audit.json").read_bytes()).hexdigest() == bindings["phase10al_manifest_sha256"]
|
|
for prefix, relative in (("model", "tools/phase10am_bounded_copy_model.py"),
|
|
("tests", "tests/test_phase10am_bounded_copy_model.py")):
|
|
size, sha256 = digest(root / relative)
|
|
assert size == bindings[f"{prefix}_size"]
|
|
assert sha256 == bindings[f"{prefix}_sha256"]
|
|
tree = ast.parse((root / "tools/phase10am_bounded_copy_model.py").read_text(encoding="utf-8"))
|
|
imports = {alias.name.split(".")[0] for node in ast.walk(tree)
|
|
if isinstance(node, ast.Import) for alias in node.names}
|
|
imports.update(node.module.split(".")[0] for node in ast.walk(tree)
|
|
if isinstance(node, ast.ImportFrom) and node.module)
|
|
assert not imports.intersection({"os", "sys", "pathlib", "subprocess", "socket", "ctypes", "mmap", "time"})
|
|
contract = data["contract"]
|
|
assert contract["partial_copy_kills_and_reaps_child"] is True
|
|
assert contract["restore_failure_kills_child_and_terminates_service"] is True
|
|
assert contract["terminal_cleanup_failure_is_hard_error"] is True
|
|
assert not any(data["authorizations"].values())
|
|
assert data["decision"]["target_implementation_allowed"] is False
|
|
print("Phase-1.0AM bounded copy/restore validation passed")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|