sorokin.oleg.edu
36db9356cc
Preserve loaded draft bytes and model history, reject stale workspace and input events, and keep captured Escape under modal priority. Verified 181 focused Windows tests and strict desktop Clippy on exact inputs4; earlier full737 scope and component/native preparation evidence are archived separately. Native navigation acceptance remains pending.
83 lines
3.9 KiB
Python
83 lines
3.9 KiB
Python
"""Read-only integrity verification of this evidence archive; runs no product code."""
|
|
import datetime
|
|
import hashlib
|
|
import json
|
|
import pathlib
|
|
import stat
|
|
import zipfile
|
|
|
|
ROOT = pathlib.Path(__file__).resolve().parent
|
|
|
|
def sha(raw):
|
|
return hashlib.sha256(raw).hexdigest()
|
|
|
|
def safe_name(name):
|
|
parts = name.split("/")
|
|
assert name and not pathlib.PurePosixPath(name).is_absolute()
|
|
assert "\\" not in name and ":" not in name
|
|
assert all(part not in ("", ".", "..") for part in parts)
|
|
|
|
def ordinary(path):
|
|
assert path.is_file() and not path.is_symlink(), str(path)
|
|
assert not (getattr(path.stat(), "st_file_attributes", 0) & 0x400), str(path)
|
|
|
|
def verify():
|
|
manifest_raw = (ROOT / "manifest.json").read_bytes()
|
|
manifest = json.loads(manifest_raw)
|
|
expected = {row["path"]: row for row in manifest["payloads"]}
|
|
assert len(expected) == len(manifest["payloads"])
|
|
actual = set()
|
|
for path in ROOT.rglob("*"):
|
|
assert not path.is_symlink()
|
|
assert not (getattr(path.stat(), "st_file_attributes", 0) & 0x400)
|
|
if path.is_file():
|
|
actual.add(path.relative_to(ROOT).as_posix())
|
|
else:
|
|
assert path.is_dir()
|
|
allowed = set(expected) | {"manifest.json"}
|
|
if (ROOT / "readback.json").exists():
|
|
allowed.add("readback.json")
|
|
assert actual == allowed, {"extra": sorted(actual - allowed), "missing": sorted(allowed - actual)}
|
|
payload_bytes = 0
|
|
for name, row in expected.items():
|
|
safe_name(name)
|
|
path = ROOT / name
|
|
ordinary(path)
|
|
raw = path.read_bytes()
|
|
assert len(raw) == row["bytes"] and sha(raw) == row["sha256"], name
|
|
payload_bytes += len(raw)
|
|
snapshots = []
|
|
for label in ("inputs1", "inputs2"):
|
|
captured = json.loads((ROOT / (label + ".json")).read_text(encoding="utf-8"))
|
|
records = {row["path"]: row for row in captured["files"]}
|
|
assert len(records) == len(captured["files"])
|
|
archive = ROOT / (label + ".zip")
|
|
assert sha(archive.read_bytes()) == captured["archiveSha256"]
|
|
with zipfile.ZipFile(archive) as z:
|
|
infos = z.infolist()
|
|
assert len(infos) == len(records) and set(z.namelist()) == set(records)
|
|
folded = set()
|
|
for info in infos:
|
|
name = info.filename
|
|
safe_name(name)
|
|
assert not info.is_dir() and not (info.flag_bits & 1)
|
|
assert not stat.S_ISLNK(info.external_attr >> 16)
|
|
assert name.lower() not in folded
|
|
folded.add(name.lower())
|
|
raw = z.read(info)
|
|
assert len(raw) == records[name]["bytes"] and sha(raw) == records[name]["sha256"], name
|
|
historical = json.loads((ROOT / (label + "-readback.json")).read_text(encoding="utf-8"))
|
|
assert historical["passed"] and all(not historical[k] for k in ("changed", "added", "removed"))
|
|
snapshots.append({"label": label, "members": len(records), "source_bytes": sum(r["bytes"] for r in records.values()), "zip_sha256": captured["archiveSha256"], "safe_exact_member_readback": True})
|
|
result = {"verified_at_utc": datetime.datetime.now(datetime.timezone.utc).isoformat(), "passed": True, "manifest_sha256": sha(manifest_raw), "payload_files": len(expected), "payload_bytes": payload_bytes, "source_copies": sum(row["provenance"] == "exact original bytes" for row in expected.values()), "exact_file_set": True, "snapshots": snapshots}
|
|
receipt = ROOT / "readback.json"
|
|
if receipt.exists():
|
|
prior = json.loads(receipt.read_text(encoding="utf-8"))
|
|
assert prior["passed"] and prior["manifest_sha256"] == result["manifest_sha256"]
|
|
for key in ("payload_files", "payload_bytes", "source_copies", "exact_file_set", "snapshots"):
|
|
assert prior[key] == result[key], key
|
|
return result
|
|
|
|
if __name__ == "__main__":
|
|
print(json.dumps(verify(), indent=2, ensure_ascii=False))
|