"""Read-only evidence checks for the explicitly experimental C# USB profile."""
import argparse
import base64
import hashlib
import json
import os
from pathlib import Path
import shutil
import struct
import subprocess
import sys
import xml.etree.ElementTree as ET
ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "Tools" / "CSharpBoot"))
from ReadImage import inspect_image
def digest(path):
return hashlib.sha256(Path(path).read_bytes()).hexdigest()
def read_json(path):
return json.loads(Path(path).read_text(encoding="utf-8-sig"))
def read_bound_json(path):
raw = Path(path).read_bytes()
return json.loads(raw.decode("utf-8-sig")), hashlib.sha256(raw).hexdigest()
def require(condition, message):
if not condition:
raise ValueError(message)
def verify_elf(data):
require(len(data) >= 64 and data[:7] == b"\x7fELF\x02\x01\x01" and
struct.unpack_from("<HH", data, 16) == (2, 62), "Expected a little-endian executable x86_64 ELF64 kernel")
def verify_efi(data, name):
require(len(data) >= 64 and data[:2] == b"MZ", name + ": missing DOS/PE header")
pe = struct.unpack_from("<I", data, 60)[0]
require(64 <= pe <= len(data) - 24 and data[pe:pe + 4] == b"PE\0\0", name + ": invalid PE offset/signature")
machine, sections = struct.unpack_from("<HH", data, pe + 4)
optional_size = struct.unpack_from("<H", data, pe + 20)[0]
require(machine == 0x8664 and sections > 0 and optional_size >= 70 and pe + 24 + optional_size <= len(data),
name + ": expected bounded x86_64 PE headers")
require(struct.unpack_from("<H", data, pe + 24)[0] == 0x20b and
struct.unpack_from("<H", data, pe + 24 + 68)[0] == 10, name + ": expected PE32+ EFI application")
def verify_ram_only_project(snapshot, project_path=None):
relative = "Source/XFESystem.Kernel/XFESystem.Kernel.csproj"
project_path = (ROOT / relative) if project_path is None else Path(project_path)
raw = project_path.read_bytes()
project_hash = hashlib.sha256(raw).hexdigest()
require(snapshot.get(relative) == project_hash, "Current kernel project differs from the compiled source snapshot")
root = ET.fromstring(raw)
storage = [element for element in root.iter() if element.tag.rsplit("}", 1)[-1] == "CosmosEnableStorage"]
require(len(storage) == 1 and (storage[0].text or "").strip().lower() == "false" and
not storage[0].get("Condition"), "Experimental physical test requires explicit CosmosEnableStorage=false")
parent = next((element for element in root.iter() if storage[0] in list(element)), None)
require(parent is not None and not parent.get("Condition"), "RAM-only storage setting must be unconditional")
return {"KernelProjectPath": str(project_path.resolve()), "KernelProjectSha256": project_hash,
"RamOnlyConfigurationVerified": True, "StorageEnabled": False,
"PhysicalInputHardwareAcceptancePassed": False,
"RamOnlyMeaning": "Source-bound kernel configuration disables storage; physical input/device compatibility remains unverified"}
def verify_independent_ram_profile(snapshot, manifest, boot):
relative = "Source/XFESystem.NativeKernel/KernelProfile.json"
profile_path = ROOT / relative
profile = read_json(profile_path)
require(snapshot.get(relative) == digest(profile_path), "Independent RAM-only configuration differs from its build")
require(profile.get("Kind") == "XfeIndependentKernelConfiguration" and profile.get("RamOnly") is True and
profile.get("StorageEnabled") is False and profile.get("ContainsCosmos") is False and
profile.get("Architecture") == "x86_64", "Independent kernel RAM-only configuration is required")
build = manifest.get("IndependentKernelBuild", {})
require(build.get("Kind") == "XfeIndependentKernelBuild" and build.get("Passed") is True and
build.get("ContainsCosmos") is False and build.get("BootstrapOnly") is False,
"A complete independent application kernel build is required")
require(boot.get("DesktopAcceptancePassed") is True and boot.get("ManagedRuntimeAcceptancePassed") is True and
boot.get("ContainsCosmos") is False, "Actual independent managed desktop acceptance is required")
input_proof = boot.get("DesktopInputProof", {})
require(input_proof.get("NoRenderFailures") is True and input_proof.get("MonacoRasterPaintCompleted") is True and
input_proof.get("MonacoKeyboardEditedModel") is True,
"Actual independent visible Monaco rendering and PS/2 editing acceptance is required")
require(build.get("Configuration") == profile, "The compiled configuration differs from its source")
for name, expected in snapshot.items():
path = (ROOT / name).resolve()
require(path.is_relative_to(ROOT) and path.is_file() and digest(path) == expected,
"Independent source snapshot changed: " + name)
return {"KernelConfigurationPath": str(profile_path), "KernelProjectSha256": digest(profile_path),
"KernelConfigurationSha256": digest(profile_path), "RamOnlyConfigurationVerified": True,
"StorageEnabled": False, "PhysicalInputHardwareAcceptancePassed": False,
"RamOnlyMeaning": "Independent source-bound kernel provides RAM workspace and no storage driver"}
def verify_independent_delivery(image_path, boot_path, snapshot, image_hash, boot_hash):
"""Use the production launcher's complete read-only gate before USB writes.
This is mandatory only for a new IndependentCSharp128 write. It does not
relabel historical receipts or weaken the older experimental profile.
"""
harnesses = ("Tools/IndependentKernel/TestBoot.py", "Tools/IndependentKernel/IndependentBingEvidence.py",
"Tools/IndependentKernel/IndependentDocumentEvidence.py")
bound = {}
for relative in harnesses:
expected = snapshot.get(relative)
path = ROOT / relative
require(isinstance(expected, str) and len(expected) == 64 and path.is_file() and digest(path) == expected,
"Final delivery evidence harness differs from the actual boot snapshot: " + relative)
bound[relative] = expected
launcher = ROOT / "Tools/IndependentKernel/Open.ps1"
require(launcher.is_file(), "The strict independent desktop delivery verifier is unavailable")
launcher_hash = digest(launcher)
powershell = shutil.which("powershell.exe")
require(os.name == "nt" and powershell, "Independent USB delivery requires Windows PowerShell for the strict read-only desktop verifier")
# Only a base64-encoded JSON value enters this fixed script. File paths are
# structured parameter values, never interpolated PowerShell expressions.
payload = base64.b64encode(json.dumps({"Launcher": str(launcher), "Image": str(image_path), "Boot": str(boot_path)}, ensure_ascii=True).encode("utf-8")).decode("ascii")
script = ("$ErrorActionPreference='Stop';[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false);"
"Import-Module (Join-Path $PSHOME 'Modules/Microsoft.PowerShell.Utility/Microsoft.PowerShell.Utility.psd1');"
"$config=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + payload + "'))|ConvertFrom-Json;"
"$verified=& $config.Launcher -ImagePath $config.Image -VerifiedBootResult $config.Boot -ValidateOnly;"
"if($verified.BingNativeHttpsPassed -ne $true -or $verified.DocumentWorkflowPassed -ne $true -or $verified.TerminalWorkflowPassed -ne $true)"
"{throw 'The strict independent delivery verifier did not return the actual Bing/document/terminal proof.'};"
"Write-Output 'XFE_INDEPENDENT_DELIVERY_GATE_OK';")
encoded = base64.b64encode(script.encode("utf-16-le")).decode("ascii")
completed = subprocess.run([powershell, "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded],
cwd=ROOT, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=60,
creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
require(completed.returncode == 0 and "XFE_INDEPENDENT_DELIVERY_GATE_OK" in completed.stdout.splitlines(),
"Strict independent Bing/document/terminal delivery verification failed: " + (completed.stderr or completed.stdout)[-8192:])
require(digest(launcher) == launcher_hash and digest(image_path) == image_hash and digest(boot_path) == boot_hash,
"The delivery verifier, image or boot receipt changed during read-only acceptance")
for relative, expected in bound.items():
require(digest(ROOT / relative) == expected, "An evidence harness changed during delivery acceptance: " + relative)
return {"Kind": "XfeIndependentFinalDeliveryGate", "Passed": True, "Method": "Open.ps1 -ValidateOnly",
"LauncherPath": str(launcher), "LauncherSha256": launcher_hash, "ImageSha256": image_hash,
"BootResultSha256": boot_hash, "EvidenceHarnessSha256": bound,
"BingNativeHttpsPassed": True, "DocumentWorkflowPassed": True, "TerminalWorkflowPassed": True,
"FullCssParityVerified": False, "PhysicalInputHardwareAcceptancePassed": False,
"NoVmStarted": True, "NoDiskWrites": True}
def verify(image_path, boot_path, profile="CSharpExperimental128"):
require(profile in ("CSharpExperimental128", "IndependentCSharp128"), "Unknown physical image profile")
independent = profile == "IndependentCSharp128"
require(__debug__, "Independent image inspection requires Python assertions enabled")
image_path, boot_path = Path(image_path).resolve(), Path(boot_path).resolve()
manifest_path = Path(str(image_path) + ".json")
manifest, manifest_hash = read_bound_json(manifest_path)
boot, boot_hash = read_bound_json(boot_path)
require(image_path.stat().st_size == 128 * 1024 * 1024, "Expected the 128 MiB C# image")
inspected, files = inspect_image(image_path)
verify_elf(files["System/Kernel.elf"])
verify_efi(files["EFI/BOOT/BOOTX64.EFI"], "EFI/BOOT/BOOTX64.EFI")
verify_efi(files["EFI/XFE/Limine.efi"], "EFI/XFE/Limine.efi")
raw = image_path.read_bytes()
last = len(raw) // 512 - 1
require(raw[462:510] == bytes(48), "Hybrid MBR refused")
require(struct.unpack_from("<II", raw, 454) == (1, last), "Protective MBR geometry mismatch")
require(struct.unpack_from("<I", raw, 512 + 20)[0] == 0, "Reserved GPT header field is nonzero")
require(struct.unpack_from("<I", raw, last * 512 + 20)[0] == 0, "Backup GPT reserved field is nonzero")
require(raw[512 + 56:512 + 72] == raw[last * 512 + 56:last * 512 + 72] != bytes(16), "GPT disk identities differ")
table = raw[1024:1024 + 16384]
require(table[128:] == bytes(16384 - 128), "Experimental profile requires exactly one ESP")
require(table[16:32] == bytes.fromhex("00480deec13cd04e8ed0584645535953"), "Unexpected ESP identity")
require(struct.unpack_from("<QQQ", table, 32) == (2048, last - 33, 0), "ESP bounds or attributes mismatch")
require(table[56:128].decode("utf-16-le").rstrip("\0") == "XFESystem EFI", "ESP name mismatch")
image_hash = inspected["ImageSha256"]
kernel_hash = inspected["Files"]["System/Kernel.elf"]
require(manifest.get("Kind") == "CSharpGptFat32Image", "Unexpected image build receipt")
require(manifest.get("ImageBytes") == len(raw) and manifest.get("ImageSha256") == image_hash,
"Image build receipt hash/length mismatch")
require(manifest.get("KernelLanguage") == "C# NativeAOT" and manifest.get("FullImageReadback") is True,
"Image was not verified as a C# native build")
require(manifest.get("KernelSha256") == kernel_hash, "Image build receipt kernel mismatch")
require(manifest.get("BootloaderSha256") == inspected["Files"]["EFI/BOOT/BOOTX64.EFI"] and
manifest.get("ChainloaderSha256") == inspected["Files"]["EFI/XFE/Limine.efi"], "EFI build receipt mismatch")
expected_kind = "XfeIndependentKernelBootProof" if independent else "BareMetalNativeAotBootProof"
require(boot.get("Kind") == expected_kind and boot.get("Passed") is True and
boot.get("ImageUnchanged") is True and type(boot.get("QemuExitCode")) is int and boot["QemuExitCode"] == 0,
"A passing, cleaned-up native boot receipt is required")
require(boot.get("ImageSha256") == image_hash and boot.get("KernelSha256") == kernel_hash,
"Boot receipt does not bind this exact image/kernel")
require(boot.get("BootShimSha256") == inspected["Files"]["EFI/BOOT/BOOTX64.EFI"], "Boot EFI hash mismatch")
require(boot.get("ImageVerification", {}).get("Files") == inspected["Files"], "Boot image inventory mismatch")
snapshot_path = Path(boot["SourceSnapshotPath"])
if not snapshot_path.is_absolute():
snapshot_path = boot_path.parent / snapshot_path
snapshot_path = snapshot_path.resolve()
snapshot, snapshot_hash = read_bound_json(snapshot_path)
require(snapshot_hash == boot.get("SourceSnapshotSha256"), "Compiled source snapshot hash mismatch")
kernel_source = "Source/XFESystem.NativeKernel/Kernel.cs" if independent else "Source/XFESystem.Kernel/Kernel.cs"
require(isinstance(snapshot, dict) and kernel_source in snapshot,
"Compiled source snapshot is incomplete")
for name, expected in inspected["BootShimSourceSha256"].items():
require(snapshot.get(name) == expected, "EFI source differs from the compiled source snapshot: " + name)
ram_only = verify_independent_ram_profile(snapshot, manifest, boot) if independent else verify_ram_only_project(snapshot)
delivery = verify_independent_delivery(image_path, boot_path, snapshot, image_hash, boot_hash) if independent else None
return {"Kind": "XfeCSharpExperimentalPhysicalMediaEvidence", "Profile": profile,
"Architecture": "x86_64", "ImagePath": str(image_path), "ImageBytes": len(raw), "ImageSha256": image_hash,
"KernelSha256": kernel_hash, "BootResultPath": str(boot_path), "BootResultSha256": boot_hash,
"ImageManifestPath": str(manifest_path), "ImageManifestSha256": manifest_hash,
"SourceSnapshotPath": str(snapshot_path), "SourceSnapshotSha256": snapshot_hash,
**ram_only,
**({"IndependentFinalDeliveryGate": delivery} if independent else {}),
"IndependentImageInspection": inspected, "FullReleaseQualified": False, "StabilityPassed": False,
"StabilityStatus": "Strict stability acceptance has not passed; investigation remains open",
"CudaExecutionVerified": False, "GpuRasterizationVerified": False,
"Purpose": "User-authorized experimental physical boot test; not a release or stability acceptance"}
if __name__ == "__main__":
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("image")
parser.add_argument("boot_result")
parser.add_argument("--profile", choices=("CSharpExperimental128", "IndependentCSharp128"), default="CSharpExperimental128")
arguments = parser.parse_args()
try:
print(json.dumps(verify(arguments.image, arguments.boot_result, arguments.profile), ensure_ascii=True))
except Exception as error:
print(str(error), file=sys.stderr)
raise SystemExit(1)
"""Read-only evidence checks for the explicitly experimental C# USB profile."""
import argparse
import base64
import hashlib
import json
import os
from pathlib import Path
import shutil
import struct
import subprocess
import sys
import xml.etree.ElementTree as ET
ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "Tools" / "CSharpBoot"))
from ReadImage import inspect_image
def digest(path):
return hashlib.sha256(Path(path).read_bytes()).hexdigest()
def read_json(path):
return json.loads(Path(path).read_text(encoding="utf-8-sig"))
def read_bound_json(path):
raw = Path(path).read_bytes()
return json.loads(raw.decode("utf-8-sig")), hashlib.sha256(raw).hexdigest()
def require(condition, message):
if not condition:
raise ValueError(message)
def verify_elf(data):
require(len(data) >= 64 and data[:7] == b"\x7fELF\x02\x01\x01" and
struct.unpack_from("<HH", data, 16) == (2, 62), "Expected a little-endian executable x86_64 ELF64 kernel")
def verify_efi(data, name):
require(len(data) >= 64 and data[:2] == b"MZ", name + ": missing DOS/PE header")
pe = struct.unpack_from("<I", data, 60)[0]
require(64 <= pe <= len(data) - 24 and data[pe:pe + 4] == b"PE\0\0", name + ": invalid PE offset/signature")
machine, sections = struct.unpack_from("<HH", data, pe + 4)
optional_size = struct.unpack_from("<H", data, pe + 20)[0]
require(machine == 0x8664 and sections > 0 and optional_size >= 70 and pe + 24 + optional_size <= len(data),
name + ": expected bounded x86_64 PE headers")
require(struct.unpack_from("<H", data, pe + 24)[0] == 0x20b and
struct.unpack_from("<H", data, pe + 24 + 68)[0] == 10, name + ": expected PE32+ EFI application")
def verify_ram_only_project(snapshot, project_path=None):
relative = "Source/XFESystem.Kernel/XFESystem.Kernel.csproj"
project_path = (ROOT / relative) if project_path is None else Path(project_path)
raw = project_path.read_bytes()
project_hash = hashlib.sha256(raw).hexdigest()
require(snapshot.get(relative) == project_hash, "Current kernel project differs from the compiled source snapshot")
root = ET.fromstring(raw)
storage = [element for element in root.iter() if element.tag.rsplit("}", 1)[-1] == "CosmosEnableStorage"]
require(len(storage) == 1 and (storage[0].text or "").strip().lower() == "false" and
not storage[0].get("Condition"), "Experimental physical test requires explicit CosmosEnableStorage=false")
parent = next((element for element in root.iter() if storage[0] in list(element)), None)
require(parent is not None and not parent.get("Condition"), "RAM-only storage setting must be unconditional")
return {"KernelProjectPath": str(project_path.resolve()), "KernelProjectSha256": project_hash,
"RamOnlyConfigurationVerified": True, "StorageEnabled": False,
"PhysicalInputHardwareAcceptancePassed": False,
"RamOnlyMeaning": "Source-bound kernel configuration disables storage; physical input/device compatibility remains unverified"}
def verify_independent_ram_profile(snapshot, manifest, boot):
relative = "Source/XFESystem.NativeKernel/KernelProfile.json"
profile_path = ROOT / relative
profile = read_json(profile_path)
require(snapshot.get(relative) == digest(profile_path), "Independent RAM-only configuration differs from its build")
require(profile.get("Kind") == "XfeIndependentKernelConfiguration" and profile.get("RamOnly") is True and
profile.get("StorageEnabled") is False and profile.get("ContainsCosmos") is False and
profile.get("Architecture") == "x86_64", "Independent kernel RAM-only configuration is required")
build = manifest.get("IndependentKernelBuild", {})
require(build.get("Kind") == "XfeIndependentKernelBuild" and build.get("Passed") is True and
build.get("ContainsCosmos") is False and build.get("BootstrapOnly") is False,
"A complete independent application kernel build is required")
require(boot.get("DesktopAcceptancePassed") is True and boot.get("ManagedRuntimeAcceptancePassed") is True and
boot.get("ContainsCosmos") is False, "Actual independent managed desktop acceptance is required")
input_proof = boot.get("DesktopInputProof", {})
require(input_proof.get("NoRenderFailures") is True and input_proof.get("MonacoRasterPaintCompleted") is True and
input_proof.get("MonacoKeyboardEditedModel") is True,
"Actual independent visible Monaco rendering and PS/2 editing acceptance is required")
require(build.get("Configuration") == profile, "The compiled configuration differs from its source")
for name, expected in snapshot.items():
path = (ROOT / name).resolve()
require(path.is_relative_to(ROOT) and path.is_file() and digest(path) == expected,
"Independent source snapshot changed: " + name)
return {"KernelConfigurationPath": str(profile_path), "KernelProjectSha256": digest(profile_path),
"KernelConfigurationSha256": digest(profile_path), "RamOnlyConfigurationVerified": True,
"StorageEnabled": False, "PhysicalInputHardwareAcceptancePassed": False,
"RamOnlyMeaning": "Independent source-bound kernel provides RAM workspace and no storage driver"}
def verify_independent_delivery(image_path, boot_path, snapshot, image_hash, boot_hash):
"""Use the production launcher's complete read-only gate before USB writes.
This is mandatory only for a new IndependentCSharp128 write. It does not
relabel historical receipts or weaken the older experimental profile.
"""
harnesses = ("Tools/IndependentKernel/TestBoot.py", "Tools/IndependentKernel/IndependentBingEvidence.py",
"Tools/IndependentKernel/IndependentDocumentEvidence.py")
bound = {}
for relative in harnesses:
expected = snapshot.get(relative)
path = ROOT / relative
require(isinstance(expected, str) and len(expected) == 64 and path.is_file() and digest(path) == expected,
"Final delivery evidence harness differs from the actual boot snapshot: " + relative)
bound[relative] = expected
launcher = ROOT / "Tools/IndependentKernel/Open.ps1"
require(launcher.is_file(), "The strict independent desktop delivery verifier is unavailable")
launcher_hash = digest(launcher)
powershell = shutil.which("powershell.exe")
require(os.name == "nt" and powershell, "Independent USB delivery requires Windows PowerShell for the strict read-only desktop verifier")
# Only a base64-encoded JSON value enters this fixed script. File paths are
# structured parameter values, never interpolated PowerShell expressions.
payload = base64.b64encode(json.dumps({"Launcher": str(launcher), "Image": str(image_path), "Boot": str(boot_path)}, ensure_ascii=True).encode("utf-8")).decode("ascii")
script = ("$ErrorActionPreference='Stop';[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false);"
"Import-Module (Join-Path $PSHOME 'Modules/Microsoft.PowerShell.Utility/Microsoft.PowerShell.Utility.psd1');"
"$config=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + payload + "'))|ConvertFrom-Json;"
"$verified=& $config.Launcher -ImagePath $config.Image -VerifiedBootResult $config.Boot -ValidateOnly;"
"if($verified.BingNativeHttpsPassed -ne $true -or $verified.DocumentWorkflowPassed -ne $true -or $verified.TerminalWorkflowPassed -ne $true)"
"{throw 'The strict independent delivery verifier did not return the actual Bing/document/terminal proof.'};"
"Write-Output 'XFE_INDEPENDENT_DELIVERY_GATE_OK';")
encoded = base64.b64encode(script.encode("utf-16-le")).decode("ascii")
completed = subprocess.run([powershell, "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded],
cwd=ROOT, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=60,
creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
require(completed.returncode == 0 and "XFE_INDEPENDENT_DELIVERY_GATE_OK" in completed.stdout.splitlines(),
"Strict independent Bing/document/terminal delivery verification failed: " + (completed.stderr or completed.stdout)[-8192:])
require(digest(launcher) == launcher_hash and digest(image_path) == image_hash and digest(boot_path) == boot_hash,
"The delivery verifier, image or boot receipt changed during read-only acceptance")
for relative, expected in bound.items():
require(digest(ROOT / relative) == expected, "An evidence harness changed during delivery acceptance: " + relative)
return {"Kind": "XfeIndependentFinalDeliveryGate", "Passed": True, "Method": "Open.ps1 -ValidateOnly",
"LauncherPath": str(launcher), "LauncherSha256": launcher_hash, "ImageSha256": image_hash,
"BootResultSha256": boot_hash, "EvidenceHarnessSha256": bound,
"BingNativeHttpsPassed": True, "DocumentWorkflowPassed": True, "TerminalWorkflowPassed": True,
"FullCssParityVerified": False, "PhysicalInputHardwareAcceptancePassed": False,
"NoVmStarted": True, "NoDiskWrites": True}
def verify(image_path, boot_path, profile="CSharpExperimental128"):
require(profile in ("CSharpExperimental128", "IndependentCSharp128"), "Unknown physical image profile")
independent = profile == "IndependentCSharp128"
require(__debug__, "Independent image inspection requires Python assertions enabled")
image_path, boot_path = Path(image_path).resolve(), Path(boot_path).resolve()
manifest_path = Path(str(image_path) + ".json")
manifest, manifest_hash = read_bound_json(manifest_path)
boot, boot_hash = read_bound_json(boot_path)
require(image_path.stat().st_size == 128 * 1024 * 1024, "Expected the 128 MiB C# image")
inspected, files = inspect_image(image_path)
verify_elf(files["System/Kernel.elf"])
verify_efi(files["EFI/BOOT/BOOTX64.EFI"], "EFI/BOOT/BOOTX64.EFI")
verify_efi(files["EFI/XFE/Limine.efi"], "EFI/XFE/Limine.efi")
raw = image_path.read_bytes()
last = len(raw) // 512 - 1
require(raw[462:510] == bytes(48), "Hybrid MBR refused")
require(struct.unpack_from("<II", raw, 454) == (1, last), "Protective MBR geometry mismatch")
require(struct.unpack_from("<I", raw, 512 + 20)[0] == 0, "Reserved GPT header field is nonzero")
require(struct.unpack_from("<I", raw, last * 512 + 20)[0] == 0, "Backup GPT reserved field is nonzero")
require(raw[512 + 56:512 + 72] == raw[last * 512 + 56:last * 512 + 72] != bytes(16), "GPT disk identities differ")
table = raw[1024:1024 + 16384]
require(table[128:] == bytes(16384 - 128), "Experimental profile requires exactly one ESP")
require(table[16:32] == bytes.fromhex("00480deec13cd04e8ed0584645535953"), "Unexpected ESP identity")
require(struct.unpack_from("<QQQ", table, 32) == (2048, last - 33, 0), "ESP bounds or attributes mismatch")
require(table[56:128].decode("utf-16-le").rstrip("\0") == "XFESystem EFI", "ESP name mismatch")
image_hash = inspected["ImageSha256"]
kernel_hash = inspected["Files"]["System/Kernel.elf"]
require(manifest.get("Kind") == "CSharpGptFat32Image", "Unexpected image build receipt")
require(manifest.get("ImageBytes") == len(raw) and manifest.get("ImageSha256") == image_hash,
"Image build receipt hash/length mismatch")
require(manifest.get("KernelLanguage") == "C# NativeAOT" and manifest.get("FullImageReadback") is True,
"Image was not verified as a C# native build")
require(manifest.get("KernelSha256") == kernel_hash, "Image build receipt kernel mismatch")
require(manifest.get("BootloaderSha256") == inspected["Files"]["EFI/BOOT/BOOTX64.EFI"] and
manifest.get("ChainloaderSha256") == inspected["Files"]["EFI/XFE/Limine.efi"], "EFI build receipt mismatch")
expected_kind = "XfeIndependentKernelBootProof" if independent else "BareMetalNativeAotBootProof"
require(boot.get("Kind") == expected_kind and boot.get("Passed") is True and
boot.get("ImageUnchanged") is True and type(boot.get("QemuExitCode")) is int and boot["QemuExitCode"] == 0,
"A passing, cleaned-up native boot receipt is required")
require(boot.get("ImageSha256") == image_hash and boot.get("KernelSha256") == kernel_hash,
"Boot receipt does not bind this exact image/kernel")
require(boot.get("BootShimSha256") == inspected["Files"]["EFI/BOOT/BOOTX64.EFI"], "Boot EFI hash mismatch")
require(boot.get("ImageVerification", {}).get("Files") == inspected["Files"], "Boot image inventory mismatch")
snapshot_path = Path(boot["SourceSnapshotPath"])
if not snapshot_path.is_absolute():
snapshot_path = boot_path.parent / snapshot_path
snapshot_path = snapshot_path.resolve()
snapshot, snapshot_hash = read_bound_json(snapshot_path)
require(snapshot_hash == boot.get("SourceSnapshotSha256"), "Compiled source snapshot hash mismatch")
kernel_source = "Source/XFESystem.NativeKernel/Kernel.cs" if independent else "Source/XFESystem.Kernel/Kernel.cs"
require(isinstance(snapshot, dict) and kernel_source in snapshot,
"Compiled source snapshot is incomplete")
for name, expected in inspected["BootShimSourceSha256"].items():
require(snapshot.get(name) == expected, "EFI source differs from the compiled source snapshot: " + name)
ram_only = verify_independent_ram_profile(snapshot, manifest, boot) if independent else verify_ram_only_project(snapshot)
delivery = verify_independent_delivery(image_path, boot_path, snapshot, image_hash, boot_hash) if independent else None
return {"Kind": "XfeCSharpExperimentalPhysicalMediaEvidence", "Profile": profile,
"Architecture": "x86_64", "ImagePath": str(image_path), "ImageBytes": len(raw), "ImageSha256": image_hash,
"KernelSha256": kernel_hash, "BootResultPath": str(boot_path), "BootResultSha256": boot_hash,
"ImageManifestPath": str(manifest_path), "ImageManifestSha256": manifest_hash,
"SourceSnapshotPath": str(snapshot_path), "SourceSnapshotSha256": snapshot_hash,
**ram_only,
**({"IndependentFinalDeliveryGate": delivery} if independent else {}),
"IndependentImageInspection": inspected, "FullReleaseQualified": False, "StabilityPassed": False,
"StabilityStatus": "Strict stability acceptance has not passed; investigation remains open",
"CudaExecutionVerified": False, "GpuRasterizationVerified": False,
"Purpose": "User-authorized experimental physical boot test; not a release or stability acceptance"}
if __name__ == "__main__":
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("image")
parser.add_argument("boot_result")
parser.add_argument("--profile", choices=("CSharpExperimental128", "IndependentCSharp128"), default="CSharpExperimental128")
arguments = parser.parse_args()
try:
print(json.dumps(verify(arguments.image, arguments.boot_result, arguments.profile), ensure_ascii=True))
except Exception as error:
print(str(error), file=sys.stderr)
raise SystemExit(1)
