93 lines
4.6 KiB
Python
93 lines
4.6 KiB
Python
"""External recorder for the parent-approved verifier and finite controls; no Cargo."""
|
|
from datetime import datetime, timezone
|
|
from pathlib import Path
|
|
import hashlib
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
import zipfile
|
|
|
|
LOCAL = Path(__file__).resolve().parent
|
|
REPO = LOCAL.parent
|
|
ORIGINAL = LOCAL / 'peer-union-e34-evidence-proposal-20260923'
|
|
PACKAGE = LOCAL / 'peer-union-e34-evidence-proposal-v2-20260923'
|
|
DRIVER = LOCAL / 'e34-evidence-v2-controls.py'
|
|
OUT = LOCAL / 'e34-evidence-v2-verification-run-20260923-1'
|
|
VERIFIER_SHA = '2e2186141957d9490fecd8ada6956aa1419510602735007b287b36235ae477a8'
|
|
DRIVER_SHA = '2e624c13cdac7db5f87859b90284f43174876c1d6d68d65afd6ca179528b5be1'
|
|
|
|
|
|
def pin(raw):
|
|
return {'bytes': len(raw), 'sha256': hashlib.sha256(raw).hexdigest()}
|
|
|
|
|
|
def write(name, value):
|
|
(OUT / name).write_text(json.dumps(value, indent=2) + '\n', encoding='utf-8', newline='\n')
|
|
|
|
|
|
def snapshot():
|
|
watched = sorted([*ORIGINAL.iterdir(), *PACKAGE.iterdir(),
|
|
LOCAL / 'verify-e34-evidence-v2.py', LOCAL / 'package-e34-evidence-v2.py',
|
|
DRIVER, LOCAL / 'e34-evidence-v2-review.diff', Path(__file__).resolve()])
|
|
git = lambda *args: subprocess.check_output(['git', *args], cwd=REPO).decode().strip()
|
|
with zipfile.ZipFile(PACKAGE / 'evidence.zip') as archive:
|
|
inputs = json.loads(archive.read('gates/combined-workspace-full-e34-1.inputs.json'))
|
|
observed = [{'path': item['path'], **pin((REPO / item['path']).read_bytes())} for item in inputs['inputs']]
|
|
return {'head': git('rev-parse', 'HEAD'), 'tree': git('rev-parse', 'HEAD^{tree}'),
|
|
'tracked_status': git('status', '--porcelain', '--untracked-files=no'),
|
|
'inputs': observed, 'inputs_match_recorded': observed == inputs['inputs'],
|
|
'watched': {str(path.relative_to(REPO)): pin(path.read_bytes()) for path in watched}}
|
|
|
|
|
|
def run(label, argv):
|
|
start = datetime.now(timezone.utc).isoformat()
|
|
begin = time.monotonic_ns()
|
|
with (OUT / (label + '.stdout.txt')).open('xb') as stdout, (OUT / (label + '.stderr.txt')).open('xb') as stderr:
|
|
result = subprocess.run(argv, cwd=REPO, stdout=stdout, stderr=stderr)
|
|
receipt = {'argv': argv, 'cwd': str(REPO), 'start_utc': start,
|
|
'end_utc': datetime.now(timezone.utc).isoformat(), 'duration_monotonic_ns': time.monotonic_ns() - begin,
|
|
'exit': result.returncode,
|
|
'stdout': pin((OUT / (label + '.stdout.txt')).read_bytes()),
|
|
'stderr': pin((OUT / (label + '.stderr.txt')).read_bytes())}
|
|
write(label + '.result.json', receipt)
|
|
print(json.dumps({'label': label, **receipt}), flush=True)
|
|
return result.returncode
|
|
|
|
|
|
def main():
|
|
assert pin((PACKAGE / 'verify.py').read_bytes())['sha256'] == VERIFIER_SHA
|
|
assert pin(DRIVER.read_bytes())['sha256'] == DRIVER_SHA
|
|
OUT.mkdir()
|
|
before = snapshot()
|
|
write('before.json', before)
|
|
assert before['head'] == 'e34ba27e26ede3ab55f276acc250d92b2e0c3204'
|
|
assert before['tree'] == '29f769926e2e907f0b40c3b33ec36658ee6601b7'
|
|
assert before['inputs_match_recorded'] and not before['tracked_status']
|
|
controls_exit = None
|
|
try:
|
|
positive_exit = run('positive', [sys.executable, str(PACKAGE / 'verify.py'), '--repo', str(REPO)])
|
|
positive_pass = positive_exit == 0
|
|
if positive_pass:
|
|
positive_pass = json.loads((OUT / 'positive.stdout.txt').read_bytes())['status'] == 'RECORDED_E34_GATES_VERIFIED'
|
|
if positive_pass:
|
|
controls_exit = run('controls', [sys.executable, str(DRIVER), '--repo', str(REPO), '--out', str(OUT / 'controls')])
|
|
finally:
|
|
after = snapshot()
|
|
write('after.json', after)
|
|
write('integrity.json', {'source_unchanged': before['head'] == after['head'] and before['tree'] == after['tree']
|
|
and before['tracked_status'] == after['tracked_status'] and before['inputs'] == after['inputs'],
|
|
'watched_unchanged': before['watched'] == after['watched'],
|
|
'before': pin((OUT / 'before.json').read_bytes()),
|
|
'after': pin((OUT / 'after.json').read_bytes())})
|
|
print(json.dumps({'folder': str(OUT), 'positive_pass': positive_pass, 'controls_exit': controls_exit,
|
|
'source_unchanged': before['inputs'] == after['inputs'],
|
|
'watched_unchanged': before['watched'] == after['watched']}), flush=True)
|
|
return 0 if positive_pass and controls_exit == 0 and before == after else 1
|
|
|
|
|
|
if __name__ == '__main__':
|
|
if not __debug__:
|
|
raise SystemExit('Optimized Python is not supported')
|
|
sys.exit(main())
|