83 lines
5.0 KiB
Python
83 lines
5.0 KiB
Python
"""Read-only archive integrity verifier; no imports of historical evaluators."""
|
|
from pathlib import Path, PurePosixPath
|
|
import hashlib
|
|
import json
|
|
import stat
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
PIN = '0893f3a3f0c52bc65b6b9e4d2fabdb9e76c64db973ba074ef2f1e7625500250f'
|
|
|
|
|
|
def sha(path):
|
|
return hashlib.sha256(path.read_bytes()).hexdigest()
|
|
|
|
|
|
def read(path):
|
|
return json.loads(path.read_text(encoding='utf-8'))
|
|
|
|
|
|
def require(condition, message):
|
|
if not condition:
|
|
raise AssertionError(message)
|
|
|
|
|
|
def relative(path):
|
|
parsed = PurePosixPath(path)
|
|
require(bool(parsed.parts) and not parsed.is_absolute() and parsed.as_posix() == path
|
|
and all(part not in ('', '.', '..') for part in parsed.parts)
|
|
and '\\' not in path and ':' not in path, 'Unsafe manifest path: ' + path)
|
|
return path
|
|
|
|
|
|
def main():
|
|
manifest = read(ROOT / 'MANIFEST.json')
|
|
expected = manifest['files']
|
|
require(len(expected) == manifest['file_count'], 'Archive manifest file count')
|
|
actual = {}
|
|
for path in ROOT.rglob('*'):
|
|
info = path.lstat()
|
|
require(not path.is_symlink() and not (getattr(info, 'st_file_attributes', 0) & 0x400), 'Archive reparse/symlink refused')
|
|
if stat.S_ISREG(info.st_mode) and path != ROOT / 'MANIFEST.json':
|
|
name = path.relative_to(ROOT).as_posix()
|
|
actual[name] = {'sha256': sha(path), 'bytes': info.st_size}
|
|
require(all(relative(p) for p in expected), 'Archive paths')
|
|
require(actual == expected, 'Exact archive file set, sizes and hashes')
|
|
require(sum(v['bytes'] for v in actual.values()) == manifest['total_bytes'], 'Archive byte count')
|
|
payload = ROOT / 'payload'
|
|
original_path = payload / 'evidence-manifest.json'
|
|
require(sha(original_path) == PIN == manifest['original_manifest_sha256'], 'Frozen original manifest identity')
|
|
original = read(original_path)
|
|
require(original['file_count'] == len(original['files']) == 38 and original['total_bytes'] == 1147293, 'Original 38-payload inventory')
|
|
require({p.removeprefix('payload/'): v for p, v in actual.items() if p.startswith('payload/') and p != 'payload/evidence-manifest.json'} == original['files'], 'Whitelist copy equals all original payloads')
|
|
require(not any(Path(p).suffix.lower() in {'.exe', '.dll', '.zip', '.pdb'} or '/profile/' in p or '/extracted/' in p for p in actual), 'No package binaries or profiles')
|
|
artifact = read(payload / 'artifact-result.json')
|
|
server = read(payload / 'server-result.json')
|
|
require(artifact['status'] == server['status'] == 'PASS', 'Stored terminal scopes')
|
|
require(artifact['archive']['file_count'] == len(artifact['archive']['files']) == 559, 'Stored complete package map')
|
|
require(artifact['archive']['sha256'] == 'd7228c542f162663933ea002739a78c722bcca41e437df63b7c868ea2af201f1', 'Stored ZIP identity')
|
|
for scope, result in [('artifact', artifact), ('server', server)]:
|
|
command = read(payload / (scope + '-command.json'))
|
|
require(command['exit_code'] == 0 and command['script_unchanged'] and command['frozen_inputs_unchanged'], 'Stored successful immutable invocation: ' + scope)
|
|
require(command['script_sha256'] == result['script_sha256'] == sha(payload / 'review.py'), 'Exact executed evaluator source: ' + scope)
|
|
require(command['frozen_inputs_sha256'] == result['frozen_inputs_sha256'] == sha(payload / 'frozen-inputs.json'), 'Exact frozen input binding: ' + scope)
|
|
for stream in ('stdout', 'stderr'):
|
|
require(command[stream + '_sha256'] == sha(payload / (scope + '-' + stream + '.log')), 'Exact command stream: ' + scope + '/' + stream)
|
|
http = sorted((payload / 'server-run').glob('http-*.json'))
|
|
require(len(http) == 7, 'Seven original HTTP receipts')
|
|
for path in http:
|
|
record = read(path)
|
|
require(record['body_sha256'] == sha(path.with_suffix('.body')), 'HTTP response body receipt: ' + path.name)
|
|
persisted = payload / 'server-run/data' / (server['persistence']['resource_id'] + '.json')
|
|
require(sha(persisted) == server['persistence']['disk_sha256'] and read(persisted) == server['persistence']['expected'], 'Stored complete durable envelope')
|
|
require(persisted.read_bytes() == (payload / 'server-run/http-05.body').read_bytes() == (payload / 'server-run/http-07.body').read_bytes(), 'Stored first GET, restart GET and disk bytes agree')
|
|
require([p['exit_after_explicit_terminate'] for p in server['processes']] == [1, 1], 'Explicit Windows termination codes retained')
|
|
require(read(payload / 'process-readback.json')['remaining'] == [], 'Stored later process-absence observation')
|
|
print(json.dumps({'status': 'PASS', 'scope': 'Preserved archive integrity and receipt consistency only; no application or runtime checks rerun.',
|
|
'original_payloads': original['file_count'], 'archive_files_excluding_manifest': len(actual),
|
|
'archive_bytes_excluding_manifest': manifest['total_bytes'],
|
|
'manifest_sha256': sha(ROOT / 'MANIFEST.json')}, indent=2))
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|