Package standalone source CLI with verified runtime and notices

2026-09-11 05:48:05 -07:00
parent 6a610616e7
commit 27df4a3945
23 changed files with 2239 additions and 115 deletions
@@ -0,0 +1,73 @@
+#Requires -Version 5.1
+# Inert PE fixtures and archive checks. No Cargo, builds or executable launch.
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+. (Join-Path $PSScriptRoot 'package-common.ps1')
+$fixture = Join-Path ([IO.Path]::GetTempPath()) ('arcadia-cli-package-' + [guid]::NewGuid().ToString('N'))
+[void][IO.Directory]::CreateDirectory($fixture)
+$encoding = New-Object Text.UTF8Encoding($false)
+$checks = 0
+function Assert([bool]$Condition, [string]$Message) { if (-not $Condition) { throw $Message }; $script:checks++ }
+function Refuses([scriptblock]$Action, [string]$Pattern) {
+    try { & $Action; throw 'Expected refusal' } catch { Assert ($_.ToString() -match $Pattern) "Wrong refusal: $_" }
+}
+function Write-Pe([string]$Path, [string]$Import = 'kernel32.dll', [uint16]$Machine = 0x8664) {
+    [void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($Path))
+    $data = New-Object byte[] 1024
+    $stream = [IO.MemoryStream]::new($data, $true)
+    $writer = [IO.BinaryWriter]::new($stream)
+    try {
+        $writer.Write([uint16]0x5a4d)
+        $stream.Position = 0x3c; $writer.Write([uint32]0x80)
+        $stream.Position = 0x80; $writer.Write([uint32]0x4550); $writer.Write($Machine); $writer.Write([uint16]1)
+        $stream.Position = 0x94; $writer.Write([uint16]0xf0)
+        $stream.Position = 0x98; $writer.Write([uint16]0x20b)
+        $stream.Position = 0x110; $writer.Write([uint32]0x1000)
+        $stream.Position = 0x190; $writer.Write([uint32]512); $writer.Write([uint32]0x1000); $writer.Write([uint32]512); $writer.Write([uint32]512)
+        $stream.Position = 524; $writer.Write([uint32]0x1040)
+        $stream.Position = 576; $writer.Write([Text.Encoding]::ASCII.GetBytes($Import)); $writer.Write([byte]0)
+        [IO.File]::WriteAllBytes($Path, $data)
+    } finally { $writer.Dispose() }
+}
+$bin = Join-Path $fixture 'bin'
+$cli = Join-Path $bin 'arcadia.exe'
+Write-Pe $cli
+$inspected = Get-PackageWindowsInputs $bin x86_64-pc-windows-msvc '' @('arcadia.exe')
+Assert (($inspected.Imports['arcadia.exe'] -join ',') -eq 'kernel32.dll') 'System import parse failed'
+Assert ($inspected.Inputs.Count -eq 1) 'CLI inspection requires unrelated binaries'
+Refuses { Get-PackageWindowsInputs $bin x86_64-pc-windows-msvc '' @('arcadia-studio.exe', 'arcadia-server.exe') } 'Required file missing'
+Refuses { Get-PackageWindowsInputs $bin x86_64-pc-windows-gnullvm '' @('arcadia.exe') } 'requires -LlvmMinGWRoot'
+Refuses { Get-PackageWindowsInputs $bin unsupported '' @('arcadia.exe') } 'Unsupported Windows target'
+Write-Pe $cli 'unknown-runtime.dll'
+Refuses { Get-PackageWindowsInputs $bin x86_64-pc-windows-msvc '' @('arcadia.exe') } 'Unpackaged runtime import'
+Write-Pe $cli 'kernel32.dll' 0x14c
+Refuses { Get-PackageWindowsInputs $bin x86_64-pc-windows-msvc '' @('arcadia.exe') } 'Expected x86_64'
+Write-Pe $cli 'libunwind.dll'
+$runtime = Join-Path $fixture 'runtime'
+$dll = Join-Path $runtime 'x86_64-w64-mingw32/bin/libunwind.dll'
+Write-Pe $dll 'unknown-transitive.dll'
+[IO.File]::WriteAllText((Join-Path $runtime 'LICENSE.TXT'), 'Synthetic license', $encoding)
+Refuses { Get-PackageWindowsInputs $bin x86_64-pc-windows-gnullvm $runtime @('arcadia.exe') } 'Unpackaged runtime import'
+Write-Pe $dll
+$inspected = Get-PackageWindowsInputs $bin x86_64-pc-windows-gnullvm $runtime @('arcadia.exe')
+Assert ($inspected.Inputs.Count -eq 3) 'Runtime and license closure absent'
+$evidencePath = Join-Path $fixture 'evidence.json'
+$evidence = @{source_identity='test'; profile='inert'; compiler='none'; target='x86_64-pc-windows-gnullvm'; binary_sha256=@{'arcadia.exe'='wrong'}}
+[IO.File]::WriteAllText($evidencePath, ($evidence | ConvertTo-Json), $encoding)
+Refuses { Read-PackageBuildEvidence $evidencePath x86_64-pc-windows-gnullvm $inspected.BinaryHashes } 'binary hash mismatch'
+$evidence.binary_sha256['arcadia.exe'] = $inspected.BinaryHashes['arcadia.exe']
+[IO.File]::WriteAllText($evidencePath, ($evidence | ConvertTo-Json), $encoding)
+$null = Read-PackageBuildEvidence $evidencePath x86_64-pc-windows-gnullvm $inspected.BinaryHashes
+Refuses { Read-PackageBuildEvidence $evidencePath x86_64-pc-windows-msvc $inspected.BinaryHashes } 'target differs'
+$stage = Join-Path $fixture 'stage'
+[void][IO.Directory]::CreateDirectory($stage)
+$null = Copy-PackageInputs $stage $inspected.Inputs $inspected.InspectedHashes
+Write-PackageChecksums $stage
+$first = Write-PackageWindowsArchive $stage (Join-Path $fixture 'first.zip') 'same-name'
+$second = Write-PackageWindowsArchive $stage (Join-Path $fixture 'second.zip') 'same-name'
+Assert ($first.SHA256 -eq $second.SHA256 -and $first.Files -eq 4) 'ZIP is not deterministic/exact'
+Refuses { Write-PackageWindowsArchive $stage (Join-Path $fixture 'first.zip') 'same-name' } 'already exists'
+Assert ((Get-FileHash (Join-Path $fixture 'first.zip')).Hash.ToLowerInvariant() -eq $first.SHA256) 'Refusal changed archive'
+Write-Pe $cli 'kernelbase.dll'
+Refuses { Copy-PackageInputs (Join-Path $fixture 'changed-stage') $inspected.Inputs $inspected.InspectedHashes } 'Input changed after inspection'
+Write-Output "PASS: $checks CLI/Windows packaging assertions; inert fixture retained at $fixture"