84 lines
4.6 KiB
Python
84 lines
4.6 KiB
Python
"""Verify published receipts and immutable Git inputs; never run archived code."""
|
|
from pathlib import Path
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
import zipfile
|
|
|
|
if sys.flags.optimize:
|
|
raise SystemExit('Optimized Python is unsupported')
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument('--repo', type=Path, required=True)
|
|
args = parser.parse_args()
|
|
base = Path(__file__).resolve().parent
|
|
source = '10d7f3340d5cd61a656dc0bcf7c143f8897c5551'
|
|
manifest = json.loads((base / 'manifest.json').read_text())
|
|
with zipfile.ZipFile(base / 'evidence.zip') as archive:
|
|
assert len(archive.namelist()) == len(set(archive.namelist())) == 13
|
|
assert set(archive.namelist()) == set(manifest)
|
|
payload = {name: archive.read(name) for name in manifest}
|
|
for name, data in payload.items():
|
|
assert manifest[name] == {'bytes':len(data), 'sha256':hashlib.sha256(data).hexdigest()}, name
|
|
|
|
receipts = {kind:json.loads(payload[f'{kind}-10d7f33.result.json']) for kind in ('list', 'typed', 'clippy')}
|
|
commands = {
|
|
'list':['cargo','test','--locked','--offline','-p','oa-core','--lib','--','--list'],
|
|
'typed':['cargo','test','--locked','--offline','-p','oa-core','--lib','language::analysis_source','--','--test-threads=1'],
|
|
'clippy':['cargo','clippy','--locked','--offline','-p','oa-core','--all-targets','--','-D','warnings'],
|
|
}
|
|
inputs = None
|
|
for kind, receipt in receipts.items():
|
|
assert receipt['source'] == receipt['head_after'] == source
|
|
assert receipt['exit'] == 0 and receipt['changed_inputs'] == []
|
|
assert receipt['command'] == commands[kind]
|
|
assert receipt['start'] < receipt['end']
|
|
assert receipt['environment']['CARGO_BUILD_JOBS'] == '1'
|
|
assert receipt['launcher_sha256'] == hashlib.sha256(payload['runner.py']).hexdigest()
|
|
current = json.loads(payload[receipt['inputs']])
|
|
assert current['source'] == source and len(current['inputs']) == 538
|
|
if inputs is None:
|
|
inputs = current['inputs']
|
|
assert current['inputs'] == inputs
|
|
|
|
listed = re.findall(r'^([^\r\n]+): test\r?$', payload['list-10d7f33.log'].decode(), re.M)
|
|
assert listed == receipts['list']['listing_members']
|
|
assert len(listed) == len(set(listed)) == receipts['list']['listing_count'] == 173
|
|
prior = json.loads(payload['prior-list-1b1c3e3.result.json'])
|
|
assert prior['source'] == '1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594' and prior['exit'] == 0
|
|
assert len(prior['listing_members']) == 167 and set(prior['listing_members']) <= set(listed)
|
|
new = {
|
|
'composition_checks_edit_record_ceiling_before_duplicate_membership',
|
|
'composition_defers_only_typed_output_size_with_independent_shrink_arithmetic',
|
|
'composition_exports_complete_borrowed_swap_witnesses_and_empty_noops',
|
|
'composition_keeps_name_storage_and_rename_record_limits_before_allocation',
|
|
'composition_rejects_stale_or_damaged_complete_batches_before_export',
|
|
'standalone_noop_apply_keeps_tighter_file_only_budget_and_output_boundary',
|
|
}
|
|
assert set(listed)-set(prior['listing_members']) == {'language::analysis_source::update::tests::'+name for name in new}
|
|
selected = {name for name in listed if name.startswith('language::analysis_source::')}
|
|
log = payload['typed-10d7f33.log'].decode()
|
|
passed = re.findall(r'^test ([^\r\n]+) \.\.\. ok\r?$', log, re.M)
|
|
assert len(passed) == len(set(passed)) == len(selected) == 65 and set(passed) == selected
|
|
assert '65 passed; 0 failed; 0 ignored; 0 measured; 108 filtered out' in log
|
|
assert receipts['list']['artifacts'] == receipts['typed']['artifacts']
|
|
assert len(receipts['typed']['artifacts']) == 1
|
|
assert receipts['typed']['artifacts'][0]['sha256'] == 'eed1520856679ecbea6ab2c3a202339775b7791cbfb2c24d74984cbde706305d'
|
|
assert 'Finished' in payload['clippy-10d7f33.log'].decode()
|
|
|
|
paths = subprocess.check_output(['git','ls-tree','-r','--name-only',source,'Cargo.toml','Cargo.lock','rust-toolchain.toml','.cargo','build','crates','assets','docs','examples','harness/fixtures','vendor'],cwd=args.repo).decode().splitlines()
|
|
assert paths == [item['path'] for item in inputs]
|
|
blobs = subprocess.check_output(['git','cat-file','--batch'],cwd=args.repo,input=''.join(f'{source}:{path}\n' for path in paths).encode())
|
|
offset = 0
|
|
for item in inputs:
|
|
end = blobs.index(b'\n',offset)
|
|
_,kind,size = blobs[offset:end].split()
|
|
size = int(size)
|
|
data = blobs[end+1:end+1+size]
|
|
assert kind == b'blob' and size == item['bytes'] and hashlib.sha256(data).hexdigest() == item['sha256'],item['path']
|
|
offset = end+size+2
|
|
assert offset == len(blobs)
|
|
print('PASS: 13 payloads; 538 immutable Git inputs; 173 listed, 167 retained + 6 new; exact 65 typed passes; strict core Clippy.')
|