47 lines
2.0 KiB
Python
47 lines
2.0 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Validate Phase-1.0AN against the hardened elfldr source."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
|
|
def digest(path: Path) -> tuple[int, str]:
|
|
data = path.read_bytes()
|
|
return len(data), hashlib.sha256(data).hexdigest()
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
parser.add_argument("--hardened-elfldr-root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
data = json.loads((args.root / "manifests/retroarch/phase-1.0an-service-lifecycle-audit.json").read_text(encoding="utf-8"))
|
|
bindings = data["source_bindings"]
|
|
assert hashlib.sha256((args.root / "manifests/retroarch/phase-1.0am-bounded-copy-model.json").read_bytes()).hexdigest() == bindings["phase10am_manifest_sha256"]
|
|
commit = subprocess.run(["git", "rev-parse", "HEAD"],
|
|
cwd=args.hardened_elfldr_root, check=True,
|
|
capture_output=True, text=True).stdout.strip()
|
|
assert commit == bindings["hardened_elfldr_commit"]
|
|
for prefix, relative in (("socksrv", "socksrv.c"), ("pt", "pt.c"),
|
|
("main", "main.c"), ("elfldr", "elfldr.c")):
|
|
size, sha256 = digest(args.hardened_elfldr_root / relative)
|
|
assert size == bindings[f"{prefix}_size"]
|
|
assert sha256 == bindings[f"{prefix}_sha256"]
|
|
assert data["service_lifecycle"]["request_handler_process_exits_125"] is True
|
|
assert data["service_lifecycle"]["service_restart_owner_present"] is False
|
|
assert data["copy_path"]["hard_deadline_or_preemption_present"] is False
|
|
assert not any(data["authorizations"].values())
|
|
assert data["decision"]["hardened_pt_copyin_reuse_allowed"] is False
|
|
print("Phase-1.0AN service lifecycle audit validation passed")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|