98 lines
5.5 KiB
JavaScript
98 lines
5.5 KiB
JavaScript
'use strict';
|
|
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const os = require('node:os');
|
|
const path = require('node:path');
|
|
const { pathToFileURL } = require('node:url');
|
|
const test = require('node:test');
|
|
|
|
const scriptPath = path.resolve(__dirname, '../../scripts/autonomous/verify-ps5-fpkg-hardware-evidence.mjs');
|
|
const scriptUrl = pathToFileURL(scriptPath).href;
|
|
const repoRoot = path.resolve(__dirname, '../..');
|
|
|
|
function productionFiles(entry) {
|
|
const absolute = path.join(repoRoot, entry);
|
|
if (!fs.existsSync(absolute)) return [];
|
|
if (fs.statSync(absolute).isFile()) return [absolute];
|
|
return fs.readdirSync(absolute, { withFileTypes: true }).flatMap(item => {
|
|
if (['node_modules', 'test', 'temp'].includes(item.name)) return [];
|
|
return productionFiles(path.relative(repoRoot, path.join(absolute, item.name)));
|
|
});
|
|
}
|
|
|
|
function validBundle() {
|
|
const capabilities = {
|
|
debugPackageRuntime: true, fpkgEnableActive: true, kernelPatchReady: true,
|
|
packageInstallerReady: true, launchServiceReady: true, processObservationReady: true,
|
|
};
|
|
return {
|
|
schema: 'chimera.ps5-fpkg-hardware-acceptance.v1',
|
|
titleId: 'PPSA17330',
|
|
source: { treeDigestAlgorithm: 'sha256-tree-v1', treeSha256: 'a'.repeat(64), immutable: true, zeroUnresolvedModules: true, staticLaunchReadiness: true },
|
|
builder: { product: 'LibProsperoPkg', version: '2.6.0', revision: '9084c0e88cd8d7cd9c0b353b8b6b89f7d1cc4275', bridgeAbi: 'chimera-prospero-bridge-v4', patched: false, bridgeSha256: 'b'.repeat(64) },
|
|
artifact: { extension: '.pkg', magic: '7f464948', container: 'FIH', debug: true, retail: false, sha256: 'c'.repeat(64), installedSha256: 'c'.repeat(64), structuralValidationAccepted: true },
|
|
controls: { sourceUnchanged: true, installRouteRecorded: true, runtimeRecorded: true, consoleConfigurationRecorded: true, simultaneousChangesExplained: true },
|
|
operation: {
|
|
status: 'launch_verified', titleId: 'PPSA17330', installed: true, launchVerified: true, productionRestorable: true,
|
|
packageIdentitySha256: 'd'.repeat(64), evidence: { source: 'post-install-console-scan', titleId: 'PPSA17330' },
|
|
launchEvidence: {
|
|
titleId: 'PPSA17330', packageIdentitySha256: 'd'.repeat(64), runtimeFingerprint: 'e'.repeat(64),
|
|
runtime: { capabilities }, request: { accepted: true }, observationCount: 2,
|
|
firstObservedAt: 1000, lastObservedAt: 12000,
|
|
process: { pid: 42, name: 'eboot.bin', titleId: 'PPSA17330' },
|
|
boundaries: { verifyImage: 'passed', pfsMount: 'passed', executable: 'reached', process: 'stable', basis: 'stable-exact-title-process' },
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
test('hardware evidence gate accepts only a complete launch_verified bundle', async () => {
|
|
const { validateHardwareEvidence } = await import(scriptUrl);
|
|
const report = validateHardwareEvidence(validBundle());
|
|
assert.equal(report.accepted, true);
|
|
assert.equal(report.checks.every(item => item.pass), true);
|
|
assert.equal(report.productionRestorable, true);
|
|
});
|
|
|
|
test('only launch_verified can make productionRestorable true in code and manifests', () => {
|
|
const files = ['main.js', 'preload.js', 'src', 'renderer']
|
|
.flatMap(productionFiles)
|
|
.filter(file => /\.(?:c?js|mjs)$/.test(file));
|
|
const assignments = files.flatMap(file => {
|
|
const source = fs.readFileSync(file, 'utf8');
|
|
return [...source.matchAll(/productionRestorable\s*:\s*true/g)].map(match => ({ file, source, index: match.index }));
|
|
});
|
|
assert.equal(assignments.length, 1, assignments.map(item => path.relative(repoRoot, item.file)).join(', '));
|
|
assert.equal(path.basename(assignments[0].file), 'ps5-native-package-install-service.js');
|
|
const qualifyingUpdate = assignments[0].source.slice(Math.max(0, assignments[0].index - 120), assignments[0].index + 80);
|
|
assert.match(qualifyingUpdate, /status:\s*'launch_verified'[\s\S]*launchVerified:\s*true[\s\S]*productionRestorable:\s*true/);
|
|
|
|
const schema = JSON.parse(fs.readFileSync(path.join(repoRoot, 'schemas/ps5-native-package-manifest.schema.json'), 'utf8'));
|
|
assert.deepEqual(schema.properties.launchVerified, { const: false });
|
|
assert.deepEqual(schema.properties.productionRestorable, { const: false });
|
|
});
|
|
|
|
test('hardware evidence gate rejects install-only and acknowledgement-only bundles', async () => {
|
|
const { validateHardwareEvidence } = await import(scriptUrl);
|
|
for (const mutate of [
|
|
bundle => { bundle.operation.status = 'installed_observed'; bundle.operation.launchVerified = false; bundle.operation.productionRestorable = false; },
|
|
bundle => { bundle.operation.launchEvidence.observationCount = 0; bundle.operation.launchEvidence.process = null; },
|
|
bundle => { bundle.artifact.installedSha256 = 'f'.repeat(64); },
|
|
bundle => { bundle.operation.launchEvidence.runtime.capabilities.fpkgEnableActive = false; },
|
|
]) {
|
|
const bundle = validBundle(); mutate(bundle);
|
|
assert.equal(validateHardwareEvidence(bundle).accepted, false);
|
|
}
|
|
});
|
|
|
|
test('hardware evidence command is read-only and emits a machine-readable report', async t => {
|
|
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'chimera-hw-gate-')); t.after(() => fs.rmSync(root, { recursive: true, force: true }));
|
|
const bundlePath = path.join(root, 'evidence.json'); fs.writeFileSync(bundlePath, JSON.stringify(validBundle()));
|
|
const { spawnSync } = require('node:child_process');
|
|
const result = spawnSync(process.execPath, [scriptPath, bundlePath], { encoding: 'utf8' });
|
|
assert.equal(result.status, 0, result.stderr);
|
|
assert.equal(JSON.parse(result.stdout).accepted, true);
|
|
assert.equal(fs.readdirSync(root).length, 1);
|
|
});
|