139 lines
5.4 KiB
Python
139 lines
5.4 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Mutation guardrails for the Phase-1.0J offline artifact."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import copy
|
|
import importlib.util
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
|
|
def load(path: Path):
|
|
spec = importlib.util.spec_from_file_location("phase10j", path)
|
|
assert spec and spec.loader
|
|
module = importlib.util.module_from_spec(spec)
|
|
sys.modules[spec.name] = module
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def require(value: bool, message: str) -> None:
|
|
if not value:
|
|
raise RuntimeError(message)
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
root = args.root.resolve()
|
|
validator = load(root / "tools/validate_retroarch_phase10j.py")
|
|
record = validator.load_json(root / "manifests/retroarch/phase-1.0j-write-firewall-diagnostic.json")
|
|
cases = []
|
|
|
|
def case(name):
|
|
def register(function):
|
|
cases.append((name, function))
|
|
return function
|
|
return register
|
|
|
|
@case("01 artifact is exact and ineligible")
|
|
def _(): require(validator.artifact_is_exact_and_ineligible(record["artifact"]), "artifact rejected")
|
|
|
|
@case("02 changed artifact hash fails")
|
|
def _():
|
|
value = dict(record["artifact"]); value["sha256"] = "0" * 64
|
|
require(not validator.artifact_is_exact_and_ineligible(value), "changed hash accepted")
|
|
|
|
@case("03 execution eligibility fails")
|
|
def _():
|
|
value = dict(record["artifact"]); value["execution_eligible"] = True
|
|
require(not validator.artifact_is_exact_and_ineligible(value), "eligible artifact accepted")
|
|
|
|
@case("04 all current authorizations are false")
|
|
def _(): require(validator.all_false(record["current_authorizations"], validator.AUTHORIZATION_FIELDS), "authorization active")
|
|
|
|
@case("05 connection authorization fails")
|
|
def _():
|
|
value = dict(record["current_authorizations"]); value["ps5_connection_authorized"] = True
|
|
require(not validator.all_false(value, validator.AUTHORIZATION_FIELDS), "connection authorized")
|
|
|
|
@case("06 no device action occurred")
|
|
def _(): require(validator.all_false(record["phase_actions"], validator.DEVICE_ACTION_FIELDS), "device action recorded")
|
|
|
|
@case("07 offline build is recorded")
|
|
def _(): require(record["phase_actions"]["target_build_performed"] is True, "build hidden")
|
|
|
|
@case("08 J protocol is exact")
|
|
def _(): require(validator.protocol_is_bounded(record["protocol"]), "protocol rejected")
|
|
|
|
@case("09 protocol magic mutation fails")
|
|
def _():
|
|
value = dict(record["protocol"]); value["magic"] = "CHD10H01"
|
|
require(not validator.protocol_is_bounded(value), "old magic accepted")
|
|
|
|
@case("10 target socket claim fails")
|
|
def _():
|
|
value = dict(record["protocol"]); value["target_socket_created"] = True
|
|
require(not validator.protocol_is_bounded(value), "socket creation accepted")
|
|
|
|
@case("11 live runner J activation fails")
|
|
def _():
|
|
value = dict(record["protocol"]); value["live_runner_supports_j"] = True
|
|
require(not validator.protocol_is_bounded(value), "live J runner accepted")
|
|
|
|
@case("12 firewall stops before I04")
|
|
def _(): require(validator.firewall_is_fail_closed(record["write_firewall"]), "firewall rejected")
|
|
|
|
@case("13 successful write claim fails")
|
|
def _():
|
|
value = copy.deepcopy(record["write_firewall"]); value["write_succeeds"] = True
|
|
require(not validator.firewall_is_fail_closed(value), "successful write accepted")
|
|
|
|
@case("14 late stop claim fails")
|
|
def _():
|
|
value = copy.deepcopy(record["write_firewall"]); value["stop_before"] = "D04"
|
|
require(not validator.firewall_is_fail_closed(value), "late stop accepted")
|
|
|
|
@case("15 flip instrumentation is bounded")
|
|
def _(): require(validator.flip_instrumentation_is_bounded(record["flip_diagnostic"]), "flip instrumentation rejected")
|
|
|
|
@case("16 multiple submit claim fails")
|
|
def _():
|
|
value = dict(record["flip_diagnostic"]); value["submit_count_maximum_per_reached_helper"] = 2
|
|
require(not validator.flip_instrumentation_is_bounded(value), "multiple submit accepted")
|
|
|
|
@case("17 reporting before errno capture fails")
|
|
def _():
|
|
value = dict(record["flip_diagnostic"]); value["reporting_before_errno_save"] = True
|
|
require(not validator.flip_instrumentation_is_bounded(value), "clobbered errno accepted")
|
|
|
|
@case("18 frame zero is not a root cause claim")
|
|
def _(): require(record["flip_diagnostic"]["root_cause_claimed"] is False, "root cause invented")
|
|
|
|
@case("19 static audit rejects a receive import")
|
|
def _():
|
|
value = copy.deepcopy(record["artifact_audit"]); value["receive_import"] = True
|
|
require(not validator.audit_is_bounded(value), "receive import accepted")
|
|
|
|
@case("20 host tests are not hardware evidence")
|
|
def _(): require(record["tests"]["hardware_evidence_from_phase10j"] is False, "hardware proof invented")
|
|
|
|
failures = []
|
|
for name, function in cases:
|
|
try:
|
|
function(); print(f"PASS {name}")
|
|
except Exception as error: # noqa: BLE001 - mutation harness
|
|
failures.append(f"{name}: {error}"); print(f"FAIL {name}: {error}")
|
|
if failures:
|
|
return 1
|
|
print(f"Phase-1.0J guardrails passed: {len(cases)}")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|