57 lines
2.7 KiB
Python
57 lines
2.7 KiB
Python
"""Read-only verification of the nested-default admission evidence."""
|
|
from pathlib import Path
|
|
import hashlib
|
|
import json
|
|
import zipfile
|
|
|
|
root = Path(__file__).resolve().parent
|
|
|
|
|
|
def digest(data):
|
|
return {'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()}
|
|
|
|
|
|
def require(condition, message):
|
|
if not condition:
|
|
raise SystemExit(message)
|
|
|
|
|
|
def read_json(path):
|
|
return json.loads(path.read_text(encoding='utf-8'))
|
|
|
|
|
|
manifest = read_json(root / 'files.json')
|
|
paths = {p.relative_to(root).as_posix() for p in root.rglob('*') if p.is_file() and p.name != 'files.json' and '__pycache__' not in p.parts}
|
|
require(paths == set(manifest), 'Archive membership mismatch')
|
|
for name, expected in manifest.items():
|
|
require(digest((root / name).read_bytes()) == expected, f'File mismatch: {name}')
|
|
gate = root / 'admission-1'
|
|
result = read_json(gate / 'result.json')
|
|
started = read_json(gate / 'started.json')
|
|
require(all(result[k] == v for k, v in started.items()), 'Start/result mismatch')
|
|
require(result['exitCode'] == 0 and result['inputsUnchanged'], 'Gate failed or inputs changed')
|
|
for key, filename in (('inputs', 'inputs.json'), ('archive', 'inputs.zip'), ('stdout', 'stdout.log'), ('stderr', 'stderr.log')):
|
|
require(digest((gate / filename).read_bytes()) == result[key], f'Receipt mismatch: {key}')
|
|
require(digest((root / 'gate.py').read_bytes()) == result['helper'], 'Runner mismatch')
|
|
inputs = read_json(gate / 'inputs.json')
|
|
require(len(inputs) == result['inputCount'] == 606, 'Input count mismatch')
|
|
with zipfile.ZipFile(gate / 'inputs.zip') as archive:
|
|
require(len(archive.namelist()) == len(inputs) and set(archive.namelist()) == set(inputs), 'ZIP membership mismatch')
|
|
for name, expected in inputs.items():
|
|
require(digest(archive.read(name)) == expected, f'Input mismatch: {name}')
|
|
stdout = (gate / 'stdout.log').read_text(encoding='utf-8')
|
|
require('test result: ok. 10 passed; 0 failed; 0 ignored;' in stdout, 'Unexpected outcome')
|
|
tests = [s for s in stdout.splitlines() if s.startswith('test ') and ' ... ' in s]
|
|
require(len(tests) == 10 and all(s.endswith(' ... ok') for s in tests), 'Named test outcome mismatch')
|
|
artifacts = []
|
|
for line in stdout.splitlines():
|
|
try:
|
|
item = json.loads(line)
|
|
except json.JSONDecodeError:
|
|
continue
|
|
if isinstance(item, dict) and item.get('reason') == 'compiler-artifact' and item.get('executable'):
|
|
artifacts.append(item)
|
|
require(artifacts == [a['cargo'] for a in result['artifacts']] and len(artifacts) == 1, 'Artifact receipt mismatch')
|
|
print(f'Verified {len(manifest)} pinned files, 606 captured inputs and ten passing nested-admission tests.')
|
|
print('This verifies recorded Windows evidence; it does not rerun tests or establish compact writer acceptance.')
|