63 lines
4.4 KiB
Python
63 lines
4.4 KiB
Python
"""Read only preserved evidence. Does not import or execute historical helpers."""
|
|
from pathlib import Path
|
|
import hashlib
|
|
import json
|
|
|
|
BASE = Path(__file__).resolve().parent
|
|
def sha(path):
|
|
return hashlib.sha256(path.read_bytes()).hexdigest()
|
|
def read(name):
|
|
return json.loads((BASE / name).read_text(encoding='utf-8'))
|
|
def require(condition, message):
|
|
if not condition:
|
|
raise SystemExit('FAIL: ' + message)
|
|
|
|
manifest = read('MANIFEST.json')
|
|
expected = {item['path'] for item in manifest['files']}
|
|
actual = {p.relative_to(BASE).as_posix() for p in BASE.rglob('*') if p.is_file()} - {'MANIFEST.json'}
|
|
require(actual == expected, 'archive file set')
|
|
for item in manifest['files']:
|
|
p = BASE / item['path']
|
|
require(p.resolve().is_relative_to(BASE), 'path containment')
|
|
require(p.stat().st_size == item['bytes'] and sha(p) == item['sha256'], item['path'])
|
|
require(sha(BASE/'ORIGINALS.json') == 'ef655a81362a661d9ffe0d534b760c6d9b395b5aa05f5b0b4d9194ac645743fa', 'original whitelist pin')
|
|
originals = read('ORIGINALS.json')['files']
|
|
require(len(originals) == 58, 'original count')
|
|
for item in originals:
|
|
p = BASE/item['path']
|
|
require(p.stat().st_size == item['bytes'] and sha(p) == item['sha256'], 'original '+item['path'])
|
|
prefix = 'payload/trial/'
|
|
binding = read('payload/binding.json')
|
|
require(sha(BASE/'payload/binding.json') == read(prefix+'admission.json')['binding_sha256'], 'admission binding')
|
|
require(binding['archive_sha256'] == 'd7228c542f162663933ea002739a78c722bcca41e437df63b7c868ea2af201f1' and binding['archive_bytes'] == 32971712, 'ZIP binding')
|
|
before = read(prefix+'package-before.json')
|
|
require(len(before) == 559, 'package map count')
|
|
for name in ['navigation-final-saved-package.json', 'navigation-final-saved-after-oracle-package.json', 'after-close-readonly-package.json']:
|
|
receipt = read(prefix+name)
|
|
require(receipt['files'] == before and receipt['archive_sha256'] == binding['archive_sha256'], name)
|
|
checkpoint = prefix+'checkpoints/navigation-final-saved/'
|
|
sources = read(checkpoint+'sources.json')
|
|
require(len(sources) == 4 and sources == read(prefix+'source-before.json'), 'source map baseline')
|
|
for name, digest in sources.items():
|
|
require(sha(BASE/checkpoint/'sources'/name) == digest, 'source '+name)
|
|
oracle = read(checkpoint+'result.json')
|
|
require(oracle['exitCode'] == 0 and oracle['oracle_sha256'] == '967d9ba3c6fb3a7efb410833903ec94556ca2d48a67d5072c8bb160f40a00f9c', 'recorded oracle')
|
|
require('PASS exact model/identity/4 reachable sources; 4 exact disk files' in (BASE/checkpoint/'stdout.log').read_text(), 'oracle output')
|
|
modules = read(prefix+'loaded-modules.json')
|
|
require(modules['status'] == 'PASS' and len(modules['modules']) == 126 and all(m['windowsPath'] or m['packagePath'] for m in modules['modules']), 'recorded module scope')
|
|
closed = read(prefix+'closed-readonly.json')
|
|
process = read(prefix+'closed-readonly-process.json')
|
|
require(closed['status'] == 'PASS' and closed['completePackageUnchanged'], 'closure receipt')
|
|
require(sha(BASE/prefix/'closed-readonly-process.json') == closed['process_receipt_sha256'] and sha(BASE/prefix/'after-close-readonly-package.json') == closed['package_receipt_sha256'], 'closure links')
|
|
require(process['pid'] == read(prefix+'launch.json')['pid'] == 1348 and process['originalCreationFiletime'] == process['currentCreationFiletime'] == read(prefix+'process-identity.json')['creation_filetime'] == 134336355202397809 and process['exitCodeQueried'] == 0 and process['originalProcessAbsent'], 'terminal process identity')
|
|
require(sha(BASE/'payload/close_readonly.py') == '16921ad616344132c4f1a7cd8fc49276dbbb8ee32415432d5b1604eb73fae43c', 'root-reviewed closure helper')
|
|
require(read('payload/original-close-observation.json')['original_win32_error'] is None and not (BASE/prefix/'closed.json').exists(), 'original failure preserved')
|
|
shots = BASE/prefix/'screenshots'
|
|
require(len(list(shots.glob('*.jpg'))) == len(list(shots.glob('*.json'))) == 11, 'capture counts')
|
|
for p in shots.glob('*.json'):
|
|
meta = json.loads(p.read_text(encoding='utf-8'))
|
|
require(len(meta['screenshots']) == 1, 'single capture')
|
|
capture = meta['screenshots'][0]
|
|
require(capture['width'] == 1442 and capture['height'] == 932 and (shots/capture['filename']).is_file(), 'capture metadata')
|
|
print('PASS preserved native archive: 58 original files; 11 captures; 559-file maps; 4 exact sources; recorded oracle/modules/terminal closure relationships. No runtime checks rerun.')
|