mirror of
https://github.com/PR0M3TH3AN/TORCH.git
synced 2026-11-06 04:42:24 +00:00
TASK-6e4ff870-a386-4a11-a59c-444ebc23732e: add hermetic candidate checks
This commit is contained in:
thePR0M3TH3AN committed
1 parent
1a2b5b0fec
commit
9946a2a3e4
5 files changed
+502
No files matched your search
@@ -0,0 +1,135 @@
|
||||
import { createHash } from 'node:crypto';
|
||||
import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, writeFileSync } from 'node:fs';
|
||||
import { isAbsolute, join, relative, resolve } from 'node:path';
|
||||
import { TorchError } from '../kernel/errors.mjs';
|
||||
|
||||
export const ARTIFACT_MANIFEST_FILE = '.torch-artifact-manifest-v1.json';
|
||||
export const ARTIFACT_MANIFEST_LIMITS = Object.freeze({ maxFiles: 64, maxFileBytes: 1_048_576, maxTotalBytes: 8_388_608 });
|
||||
|
||||
function fail(message, code, details) {
|
||||
throw new TorchError(message, { code, details });
|
||||
}
|
||||
|
||||
function canonicalJson(value) {
|
||||
return JSON.stringify(value);
|
||||
}
|
||||
|
||||
function digest(value) {
|
||||
return createHash('sha256').update(canonicalJson(value)).digest('hex');
|
||||
}
|
||||
|
||||
function limits(input = {}) {
|
||||
if (!input || typeof input !== 'object' || Array.isArray(input)) fail('Artifact limits must be an object', 'CANDIDATE_ARTIFACT_LIMIT_INVALID');
|
||||
const result = {};
|
||||
for (const [key, maximum] of Object.entries(ARTIFACT_MANIFEST_LIMITS)) {
|
||||
const value = input[key] ?? maximum;
|
||||
if (!Number.isInteger(value) || value < 1 || value > maximum) fail('Artifact limit is invalid', 'CANDIDATE_ARTIFACT_LIMIT_INVALID', { key, value, maximum });
|
||||
result[key] = value;
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
export function assertArtifactRelativePath(path) {
|
||||
if (typeof path !== 'string' || !path || isAbsolute(path) || path.includes('\\')
|
||||
|| path.split('/').some((part) => !part || part === '.' || part === '..')) {
|
||||
fail('Artifact path is not canonical relative evidence', 'CANDIDATE_ARTIFACT_PATH_INVALID', { path });
|
||||
}
|
||||
return path;
|
||||
}
|
||||
|
||||
export function artifactNodeKind(stat, path) {
|
||||
if (stat.isSymbolicLink()) fail('Artifact cannot be a link', 'CANDIDATE_ARTIFACT_LINK_REJECTED', { path });
|
||||
if (stat.isDirectory()) return 'directory';
|
||||
if (stat.isFile()) return 'file';
|
||||
fail('Artifact must be a regular file or directory', 'CANDIDATE_ARTIFACT_SPECIAL_REJECTED', { path });
|
||||
}
|
||||
|
||||
function inventory(root, configuredLimits) {
|
||||
const files = [];
|
||||
let totalBytes = 0;
|
||||
function visit(current, parent = '') {
|
||||
for (const name of readdirSync(current).sort()) {
|
||||
if (!parent && name === ARTIFACT_MANIFEST_FILE) continue;
|
||||
const path = parent ? `${parent}/${name}` : name;
|
||||
assertArtifactRelativePath(path);
|
||||
const absolute = join(current, name);
|
||||
const stat = lstatSync(absolute);
|
||||
const kind = artifactNodeKind(stat, path);
|
||||
if (kind === 'directory') visit(absolute, path);
|
||||
else {
|
||||
if (stat.size > configuredLimits.maxFileBytes) fail('Artifact exceeds per-file limit', 'CANDIDATE_ARTIFACT_LIMIT_EXCEEDED', { path });
|
||||
totalBytes += stat.size;
|
||||
if (files.length + 1 > configuredLimits.maxFiles || totalBytes > configuredLimits.maxTotalBytes) {
|
||||
fail('Artifact manifest exceeds aggregate limits', 'CANDIDATE_ARTIFACT_LIMIT_EXCEEDED');
|
||||
}
|
||||
const bytes = readFileSync(absolute);
|
||||
files.push({ path, bytes: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex') });
|
||||
}
|
||||
}
|
||||
}
|
||||
visit(root);
|
||||
return { files: files.sort((left, right) => left.path.localeCompare(right.path)), totalBytes };
|
||||
}
|
||||
|
||||
function validateManifest(manifest, configuredLimits) {
|
||||
if (!manifest || manifest.schema !== 'torch.dev/artifact-manifest/v1alpha1' || !Array.isArray(manifest.files)
|
||||
|| !Number.isInteger(manifest.totalBytes) || typeof manifest.sealDigest !== 'string') {
|
||||
fail('Artifact manifest is malformed', 'CANDIDATE_ARTIFACT_MANIFEST_INVALID');
|
||||
}
|
||||
const seen = new Set();
|
||||
let totalBytes = 0;
|
||||
for (const record of manifest.files) {
|
||||
assertArtifactRelativePath(record?.path);
|
||||
if (seen.has(record.path)) fail('Artifact manifest contains duplicate paths', 'CANDIDATE_ARTIFACT_MANIFEST_INVALID');
|
||||
seen.add(record.path);
|
||||
if (!Number.isInteger(record.bytes) || record.bytes < 0 || record.bytes > configuredLimits.maxFileBytes
|
||||
|| !/^[0-9a-f]{64}$/.test(record.sha256 ?? '')) fail('Artifact manifest record is invalid', 'CANDIDATE_ARTIFACT_MANIFEST_INVALID');
|
||||
totalBytes += record.bytes;
|
||||
}
|
||||
if (manifest.files.length > configuredLimits.maxFiles || totalBytes !== manifest.totalBytes || totalBytes > configuredLimits.maxTotalBytes) {
|
||||
fail('Artifact manifest limits do not match', 'CANDIDATE_ARTIFACT_MANIFEST_INVALID');
|
||||
}
|
||||
const sorted = [...manifest.files].sort((left, right) => left.path.localeCompare(right.path));
|
||||
if (canonicalJson(sorted) !== canonicalJson(manifest.files)) fail('Artifact manifest paths are not canonical', 'CANDIDATE_ARTIFACT_MANIFEST_INVALID');
|
||||
const payload = { schema: manifest.schema, files: manifest.files, totalBytes: manifest.totalBytes };
|
||||
if (digest(payload) !== manifest.sealDigest) fail('Artifact manifest seal digest is invalid', 'CANDIDATE_ARTIFACT_SEAL_INVALID');
|
||||
return payload;
|
||||
}
|
||||
|
||||
function ownedRoot(directory) {
|
||||
if (typeof directory !== 'string' || !directory || !existsSync(directory)) fail('Artifact directory is missing', 'CANDIDATE_ARTIFACT_DIRECTORY_INVALID');
|
||||
const root = realpathSync(directory);
|
||||
if (!lstatSync(root).isDirectory()) fail('Artifact directory is not a directory', 'CANDIDATE_ARTIFACT_DIRECTORY_INVALID');
|
||||
return root;
|
||||
}
|
||||
|
||||
export function sealArtifactManifest({ directory, limits: requestedLimits } = {}) {
|
||||
const root = ownedRoot(directory);
|
||||
const configuredLimits = limits(requestedLimits);
|
||||
const path = join(root, ARTIFACT_MANIFEST_FILE);
|
||||
if (existsSync(path)) fail('Artifact manifest is already sealed', 'CANDIDATE_ARTIFACT_ALREADY_SEALED');
|
||||
const records = inventory(root, configuredLimits);
|
||||
const payload = { schema: 'torch.dev/artifact-manifest/v1alpha1', ...records };
|
||||
const manifest = { ...payload, sealDigest: digest(payload) };
|
||||
writeFileSync(path, `${canonicalJson(manifest)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
|
||||
return Object.freeze({ ...manifest, manifestPath: path });
|
||||
}
|
||||
|
||||
export function verifyArtifactManifest({ directory, limits: requestedLimits } = {}) {
|
||||
const root = ownedRoot(directory);
|
||||
const configuredLimits = limits(requestedLimits);
|
||||
const path = join(root, ARTIFACT_MANIFEST_FILE);
|
||||
if (!existsSync(path)) fail('Artifact manifest is missing', 'CANDIDATE_ARTIFACT_MANIFEST_MISSING');
|
||||
let manifest;
|
||||
try { manifest = JSON.parse(readFileSync(path, 'utf8')); }
|
||||
catch { fail('Artifact manifest cannot be parsed', 'CANDIDATE_ARTIFACT_MANIFEST_INVALID'); }
|
||||
const payload = validateManifest(manifest, configuredLimits);
|
||||
const current = inventory(root, configuredLimits);
|
||||
if (canonicalJson(current) !== canonicalJson({ files: payload.files, totalBytes: payload.totalBytes })) {
|
||||
fail('Artifact contents changed after sealing', 'CANDIDATE_ARTIFACT_SEAL_DRIFT');
|
||||
}
|
||||
if (resolve(path) !== join(root, ARTIFACT_MANIFEST_FILE) || relative(root, path).startsWith('..')) {
|
||||
fail('Artifact manifest escaped its directory', 'CANDIDATE_ARTIFACT_DIRECTORY_INVALID');
|
||||
}
|
||||
return Object.freeze({ ...manifest, manifestPath: path, verified: true });
|
||||
}
|
||||
@@ -0,0 +1,174 @@
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { TorchError } from '../kernel/errors.mjs';
|
||||
|
||||
export const CANDIDATE_ENGINE_LIMITS = Object.freeze({
|
||||
maxInputBytes: 1_048_576,
|
||||
maxDefinitionBytes: 65_536,
|
||||
maxArgs: 64,
|
||||
maxArgBytes: 4_096,
|
||||
maxEnvironmentEntries: 32,
|
||||
maxEnvironmentNameBytes: 128,
|
||||
maxEnvironmentValueBytes: 4_096,
|
||||
maxOutputBytes: 65_536,
|
||||
maxArtifactPathBytes: 4_096,
|
||||
});
|
||||
|
||||
function fail(message, code, details) {
|
||||
throw new TorchError(message, { code, details });
|
||||
}
|
||||
|
||||
function byteLength(value) {
|
||||
return Buffer.byteLength(value, 'utf8');
|
||||
}
|
||||
|
||||
function exactObject(value, allowed, label) {
|
||||
if (!value || typeof value !== 'object' || Array.isArray(value)) {
|
||||
fail(`${label} must be an object`, 'CANDIDATE_ENGINE_INPUT_INVALID');
|
||||
}
|
||||
for (const key of Object.keys(value)) {
|
||||
if (!allowed.has(key)) fail(`${label} contains unsupported capability data`, 'CANDIDATE_ENGINE_CAPABILITY_FORBIDDEN', { key });
|
||||
}
|
||||
}
|
||||
|
||||
function boundedString(value, limit, label) {
|
||||
if (typeof value !== 'string' || !value || byteLength(value) > limit) {
|
||||
fail(`${label} is missing or exceeds its limit`, 'CANDIDATE_ENGINE_INPUT_INVALID', { label, limit });
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
function normalizeLimits(limits = {}) {
|
||||
exactObject(limits, new Set(Object.keys(CANDIDATE_ENGINE_LIMITS)), 'limits');
|
||||
const normalized = {};
|
||||
for (const [key, maximum] of Object.entries(CANDIDATE_ENGINE_LIMITS)) {
|
||||
const value = limits[key] ?? maximum;
|
||||
if (!Number.isInteger(value) || value < 1 || value > maximum) {
|
||||
fail(`Invalid candidate-engine limit: ${key}`, 'CANDIDATE_ENGINE_LIMIT_INVALID', { key, value, maximum });
|
||||
}
|
||||
normalized[key] = value;
|
||||
}
|
||||
return Object.freeze(normalized);
|
||||
}
|
||||
|
||||
function freeze(value) {
|
||||
if (value && typeof value === 'object' && !Object.isFrozen(value)) {
|
||||
for (const item of Object.values(value)) freeze(item);
|
||||
Object.freeze(value);
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
function normalizeInput(input, limits) {
|
||||
exactObject(input, new Set(['directory', 'digest', 'bytes']), 'input');
|
||||
const directory = boundedString(input.directory, limits.maxArtifactPathBytes, 'input.directory');
|
||||
const digest = boundedString(input.digest, 128, 'input.digest');
|
||||
if (!/^[0-9a-f]{64}$/i.test(digest) || !Number.isInteger(input.bytes) || input.bytes < 0 || input.bytes > limits.maxInputBytes) {
|
||||
fail('Candidate input must be a bounded immutable fixture descriptor', 'CANDIDATE_ENGINE_INPUT_INVALID');
|
||||
}
|
||||
return freeze({ directory, digest: digest.toLowerCase(), bytes: input.bytes });
|
||||
}
|
||||
|
||||
function normalizeDefinition(definition, limits) {
|
||||
exactObject(definition, new Set(['command', 'args']), 'definition');
|
||||
const command = boundedString(definition.command, limits.maxArgBytes, 'definition.command');
|
||||
const args = normalizeArgs(definition.args ?? [], limits, 'definition.args');
|
||||
const normalized = { command, args };
|
||||
if (byteLength(JSON.stringify(normalized)) > limits.maxDefinitionBytes) {
|
||||
fail('Candidate definition exceeds its limit', 'CANDIDATE_ENGINE_INPUT_INVALID');
|
||||
}
|
||||
return freeze(normalized);
|
||||
}
|
||||
|
||||
function normalizeArgs(args, limits, label = 'args') {
|
||||
if (!Array.isArray(args) || args.length > limits.maxArgs) {
|
||||
fail(`${label} exceeds its count limit`, 'CANDIDATE_ENGINE_INPUT_INVALID');
|
||||
}
|
||||
return freeze(args.map((value) => boundedString(value, limits.maxArgBytes, label)));
|
||||
}
|
||||
|
||||
function normalizeEnvironment(environment, limits) {
|
||||
exactObject(environment, new Set(Object.keys(environment ?? {})), 'environment');
|
||||
const entries = Object.entries(environment);
|
||||
if (entries.length > limits.maxEnvironmentEntries) {
|
||||
fail('Candidate environment exceeds its entry limit', 'CANDIDATE_ENGINE_INPUT_INVALID');
|
||||
}
|
||||
const normalized = {};
|
||||
for (const [key, value] of entries.sort(([left], [right]) => left.localeCompare(right))) {
|
||||
if (!/^[A-Z_][A-Z0-9_]*$/.test(key) || byteLength(key) > limits.maxEnvironmentNameBytes) {
|
||||
fail('Candidate environment name is invalid', 'CANDIDATE_ENGINE_INPUT_INVALID', { key });
|
||||
}
|
||||
normalized[key] = boundedString(value, limits.maxEnvironmentValueBytes, `environment.${key}`);
|
||||
}
|
||||
return freeze(normalized);
|
||||
}
|
||||
|
||||
function boundedOutput(value, limit) {
|
||||
const output = typeof value === 'string' ? value : value?.toString?.() ?? '';
|
||||
const bytes = Buffer.byteLength(output);
|
||||
return { bytes, text: bytes > limit ? output.slice(0, limit) : output, overflow: bytes > limit };
|
||||
}
|
||||
|
||||
function normalizeError(error) {
|
||||
if (!error) return null;
|
||||
return {
|
||||
code: typeof error.code === 'string' ? error.code.slice(0, 128) : null,
|
||||
message: typeof error.message === 'string' ? error.message.slice(0, 512) : String(error).slice(0, 512),
|
||||
};
|
||||
}
|
||||
|
||||
function terminalObservation(result, limits) {
|
||||
const stdout = boundedOutput(result?.stdout, limits.maxOutputBytes);
|
||||
const stderr = boundedOutput(result?.stderr, limits.maxOutputBytes);
|
||||
const error = normalizeError(result?.error);
|
||||
const signal = typeof result?.signal === 'string' ? result.signal : null;
|
||||
const exitStatus = Number.isInteger(result?.status) ? result.status : null;
|
||||
const timedOut = result?.timedOut === true || error?.code === 'ETIMEDOUT';
|
||||
const overflow = stdout.overflow || stderr.overflow || error?.code === 'ENOBUFS';
|
||||
let kind = 'exit';
|
||||
if (timedOut) kind = 'timeout';
|
||||
else if (overflow) kind = 'overflow';
|
||||
else if (signal) kind = 'signal';
|
||||
else if (error) kind = 'error';
|
||||
return freeze({
|
||||
kind, exitStatus, signal, error, timedOut, overflow,
|
||||
success: kind === 'exit' && exitStatus === 0,
|
||||
stdout, stderr,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Fixture-only Phase-A seam. It deliberately exposes a raw parent observation,
|
||||
* never a receipt, capability, ControlPlane handle, or registered project root.
|
||||
*/
|
||||
export function runCandidateEngine(options = {}) {
|
||||
exactObject(options, new Set(['input', 'definition', 'args', 'environment', 'artifactDirectory', 'executor', 'limits']), 'candidate engine options');
|
||||
const limits = normalizeLimits(options.limits ?? {});
|
||||
const input = normalizeInput(options.input, limits);
|
||||
const definition = normalizeDefinition(options.definition, limits);
|
||||
const args = normalizeArgs(options.args ?? [], limits);
|
||||
const environment = normalizeEnvironment(options.environment ?? {}, limits);
|
||||
const artifactDirectory = boundedString(options.artifactDirectory, limits.maxArtifactPathBytes, 'artifactDirectory');
|
||||
const executor = options.executor ?? ((command, commandArgs, execution) => spawnSync(command, commandArgs, execution));
|
||||
if (typeof executor !== 'function') fail('Candidate executor must be a function', 'CANDIDATE_ENGINE_INPUT_INVALID');
|
||||
|
||||
let raw;
|
||||
try {
|
||||
raw = executor(definition.command, [...definition.args, ...args], freeze({
|
||||
cwd: input.directory,
|
||||
env: environment,
|
||||
encoding: 'utf8',
|
||||
stdio: ['ignore', 'pipe', 'pipe'],
|
||||
maxBuffer: limits.maxOutputBytes,
|
||||
artifactDirectory,
|
||||
}));
|
||||
} catch (error) {
|
||||
raw = { status: null, error };
|
||||
}
|
||||
const terminal = terminalObservation(raw, limits);
|
||||
return freeze({
|
||||
schema: 'torch.dev/candidate-engine-observation/v1alpha1',
|
||||
fixtureOnly: true,
|
||||
sourceAttestation: freeze({ schema: 'torch.dev/source-attestation/v1alpha1', promotion: 'nonpromotable' }),
|
||||
input, definition, args, environment, artifactDirectory, terminal,
|
||||
});
|
||||
}
|
||||
Reference in new issue
Block a user