XFESystem

"""Read-only evidence checks for the explicitly experimental C# USB profile."""
import argparse
import base64
import hashlib
import json
import os
from pathlib import Path
import shutil
import struct
import subprocess
import sys
import xml.etree.ElementTree as ET
import uuid

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "Tools" / "CSharpBoot"))
from ReadImage import inspect_image, verify_single_edition


def digest(path):
    return hashlib.sha256(Path(path).read_bytes()).hexdigest()


def read_json(path):
    return json.loads(Path(path).read_text(encoding="utf-8-sig"))


def read_bound_json(path):
    raw = Path(path).read_bytes()
    return json.loads(raw.decode("utf-8-sig")), hashlib.sha256(raw).hexdigest()


def require(condition, message):
    if not condition:
        raise ValueError(message)


def verify_elf(data):
    require(len(data) >= 64 and data[:7] == b"\x7fELF\x02\x01\x01" and
            struct.unpack_from("<HH", data, 16) == (2, 62), "Expected a little-endian executable x86_64 ELF64 kernel")


def verify_efi(data, name):
    require(len(data) >= 64 and data[:2] == b"MZ", name + ": missing DOS/PE header")
    pe = struct.unpack_from("<I", data, 60)[0]
    require(64 <= pe <= len(data) - 24 and data[pe:pe + 4] == b"PE\0\0", name + ": invalid PE offset/signature")
    machine, sections = struct.unpack_from("<HH", data, pe + 4)
    optional_size = struct.unpack_from("<H", data, pe + 20)[0]
    require(machine == 0x8664 and sections > 0 and optional_size >= 70 and pe + 24 + optional_size <= len(data),
            name + ": expected bounded x86_64 PE headers")
    require(struct.unpack_from("<H", data, pe + 24)[0] == 0x20b and
            struct.unpack_from("<H", data, pe + 24 + 68)[0] == 10, name + ": expected PE32+ EFI application")


def verify_ram_only_project(snapshot, project_path=None):
    relative = "Source/XFESystem.Kernel/XFESystem.Kernel.csproj"
    project_path = (ROOT / relative) if project_path is None else Path(project_path)
    raw = project_path.read_bytes()
    project_hash = hashlib.sha256(raw).hexdigest()
    require(snapshot.get(relative) == project_hash, "Current kernel project differs from the compiled source snapshot")
    root = ET.fromstring(raw)
    storage = [element for element in root.iter() if element.tag.rsplit("}", 1)[-1] == "CosmosEnableStorage"]
    require(len(storage) == 1 and (storage[0].text or "").strip().lower() == "false" and
            not storage[0].get("Condition"), "Experimental physical test requires explicit CosmosEnableStorage=false")
    parent = next((element for element in root.iter() if storage[0] in list(element)), None)
    require(parent is not None and not parent.get("Condition"), "RAM-only storage setting must be unconditional")
    return {"KernelProjectPath": str(project_path.resolve()), "KernelProjectSha256": project_hash,
            "RamOnlyConfigurationVerified": True, "StorageEnabled": False,
            "PhysicalInputHardwareAcceptancePassed": False,
            "RamOnlyMeaning": "Source-bound kernel configuration disables storage; physical input/device compatibility remains unverified"}


def verify_independent_ram_profile(snapshot, manifest, boot):
    relative = "Source/XFESystem.NativeKernel/KernelProfile.json"
    profile_path = ROOT / relative
    profile = read_json(profile_path)
    persistent = manifest.get('UsbWorkspace') is True
    require(snapshot.get(relative) == digest(profile_path), "Independent storage configuration differs from its build")
    require(profile.get("Kind") == "XfeIndependentKernelConfiguration" and profile.get("RamOnly") is (not persistent) and
            profile.get("StorageEnabled") is persistent and profile.get("ContainsCosmos") is False and
            profile.get("Architecture") == "x86_64", "Independent kernel RAM-only configuration is required")
    if persistent:
        require(profile.get('StorageBackend') == 'BootUsbBotFat32DualBankWorkspaceV1' and profile.get('RamFallbackWhenBootUsbUnavailable') is True and
                boot.get('UsbStorageAcceptancePassed') is True, 'Actual source-bound USB workspace configuration and persistence acceptance are required')
    build = manifest.get("IndependentKernelBuild", {})
    require(build.get("Kind") == "XfeIndependentKernelBuild" and build.get("Passed") is True and
            build.get("ContainsCosmos") is False and build.get("BootstrapOnly") is False,
            "A complete independent application kernel build is required")
    edition = 'Console' if manifest.get('Edition') == 'Console' else 'Desktop'
    require(boot.get("Edition", 'Desktop') == edition and boot.get("ManagedRuntimeAcceptancePassed") is True and
            boot.get("ContainsCosmos") is False, "Actual independent managed system acceptance is required")
    if edition == 'Console':
        require(boot.get('ConsoleAcceptanceRequired') is True and boot.get('ConsoleAcceptancePassed') is True and
                boot.get('ConsoleInputProof', {}).get('Passed') is True and boot.get('NoDesktopOrBrowserInitialization') is True,
                'Actual independent console workflow and desktop isolation acceptance is required')
    else:
        require(boot.get("DesktopAcceptancePassed") is True, 'Actual independent managed desktop acceptance is required')
        input_proof = boot.get("DesktopInputProof", {})
        require(input_proof.get("NoRenderFailures") is True and input_proof.get("MonacoRasterPaintCompleted") is True and
                input_proof.get("MonacoKeyboardEditedModel") is True,
                "Actual independent visible Monaco rendering and PS/2 editing acceptance is required")
    require(build.get("Configuration") == profile, "The compiled configuration differs from its source")
    for name, expected in snapshot.items():
        path = (ROOT / name).resolve()
        require(path.is_relative_to(ROOT) and path.is_file() and digest(path) == expected,
                "Independent source snapshot changed: " + name)
    return {"KernelConfigurationPath": str(profile_path), "KernelProjectSha256": digest(profile_path),
            "KernelConfigurationSha256": digest(profile_path), "RamOnlyConfigurationVerified": not persistent,
            "PersistentConfigurationVerified": persistent,
            "StorageEnabled": persistent, "PhysicalInputHardwareAcceptancePassed": False,
            "RamOnlyMeaning": "USB BOT workspace with explicit RAM fallback when unavailable" if persistent else "Independent source-bound kernel provides RAM workspace and no storage driver"}


def verify_independent_delivery(image_path, boot_path, snapshot, image_hash, boot_hash, edition="Desktop"):
    """Use the production launcher's complete read-only gate before USB writes.

    This is mandatory only for a new IndependentCSharp128 write. It does not
    relabel historical receipts or weaken the older experimental profile.
    """
    harnesses = ("Tools/IndependentKernel/TestBoot.py", "Tools/IndependentKernel/IndependentBingEvidence.py",
                 "Tools/IndependentKernel/IndependentDocumentEvidence.py")
    if edition == "Console":
        harnesses += ("Tools/IndependentKernel/IndependentConsoleEvidence.py",)
    if "Tools/IndependentKernel/TestUsbStorage.py" in snapshot:
        harnesses += ("Tools/IndependentKernel/TestUsbStorage.py", "Tools/CSharpBoot/ReadImage.py")
    if "Tools/IndependentKernel/TestMultiDisplay.py" in snapshot:
        harnesses += ("Tools/IndependentKernel/TestMultiDisplay.py", "Tools/IndependentKernel/VerifyMultiDisplay.ps1")
    bound = {}
    for relative in harnesses:
        expected = snapshot.get(relative)
        path = ROOT / relative
        require(isinstance(expected, str) and len(expected) == 64 and path.is_file() and digest(path) == expected,
                "Final delivery evidence harness differs from the actual boot snapshot: " + relative)
        bound[relative] = expected
    launcher = ROOT / "Tools/IndependentKernel/Open.ps1"
    require(launcher.is_file(), "The strict independent desktop delivery verifier is unavailable")
    launcher_hash = digest(launcher)
    powershell = shutil.which("powershell.exe")
    require(os.name == "nt" and powershell, "Independent USB delivery requires Windows PowerShell for the strict read-only desktop verifier")
    # Only a base64-encoded JSON value enters this fixed script. File paths are
    # structured parameter values, never interpolated PowerShell expressions.
    payload = base64.b64encode(json.dumps({"Launcher": str(launcher), "Image": str(image_path), "Boot": str(boot_path), "Edition": edition}, ensure_ascii=True).encode("utf-8")).decode("ascii")
    acceptance = ("if($verified.ConsoleWorkflowPassed -ne $true -or $verified.TerminalWorkflowPassed -ne $true)"
                  "{throw 'The strict console delivery verifier did not return actual console workflow proof.'};") if edition == "Console" else (
                  "if($verified.BingNativeHttpsPassed -ne $true -or $verified.DocumentWorkflowPassed -ne $true -or $verified.TerminalWorkflowPassed -ne $true)"
                  "{throw 'The strict independent delivery verifier did not return the actual Bing/document/terminal proof.'};")
    script = ("$ErrorActionPreference='Stop';[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false);"
              "Import-Module (Join-Path $PSHOME 'Modules/Microsoft.PowerShell.Utility/Microsoft.PowerShell.Utility.psd1');"
              "$config=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + payload + "'))|ConvertFrom-Json;"
              "$verified=& $config.Launcher -ImagePath $config.Image -VerifiedBootResult $config.Boot -Edition $config.Edition -ValidateOnly;" +
              acceptance +
              "Write-Output 'XFE_INDEPENDENT_DELIVERY_GATE_OK';")
    encoded = base64.b64encode(script.encode("utf-16-le")).decode("ascii")
    completed = subprocess.run([powershell, "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded],
                               cwd=ROOT, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=60,
                               creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
    require(completed.returncode == 0 and "XFE_INDEPENDENT_DELIVERY_GATE_OK" in completed.stdout.splitlines(),
            "Strict independent Bing/document/terminal delivery verification failed: " + (completed.stderr or completed.stdout)[-8192:])
    require(digest(launcher) == launcher_hash and digest(image_path) == image_hash and digest(boot_path) == boot_hash,
            "The delivery verifier, image or boot receipt changed during read-only acceptance")
    for relative, expected in bound.items():
        require(digest(ROOT / relative) == expected, "An evidence harness changed during delivery acceptance: " + relative)
    return {"Kind": "XfeIndependentFinalDeliveryGate", "Passed": True, "Method": "Open.ps1 -ValidateOnly",
            "LauncherPath": str(launcher), "LauncherSha256": launcher_hash, "ImageSha256": image_hash,
            "BootResultSha256": boot_hash, "EvidenceHarnessSha256": bound,
            "Edition": edition, "ConsoleWorkflowPassed": edition == "Console",
            "BingNativeHttpsPassed": edition == "Desktop", "DocumentWorkflowPassed": edition == "Desktop", "TerminalWorkflowPassed": True,
            "FullCssParityVerified": False, "PhysicalInputHardwareAcceptancePassed": False,
            "NoVmStarted": True, "NoDiskWrites": True}


def verify(image_path, boot_path, profile="CSharpExperimental128", _dual_image=False):
    if profile == "IndependentDualCSharp256":
        sys.path.insert(0, str(ROOT / "Tools" / "IndependentKernel"))
        from VerifyDualDelivery import verify_dual
        return verify_dual(image_path, boot_path)
    require(profile in ("CSharpExperimental128", "IndependentCSharp128", "IndependentCSharpUsb256"), "Unknown physical image profile")
    independent = profile in ("IndependentCSharp128", "IndependentCSharpUsb256")
    persistent = profile == "IndependentCSharpUsb256"
    require(__debug__, "Independent image inspection requires Python assertions enabled")
    image_path, boot_path = Path(image_path).resolve(), Path(boot_path).resolve()
    manifest_path = Path(str(image_path) + ".json")
    manifest, manifest_hash = read_bound_json(manifest_path)
    boot, boot_hash = read_bound_json(boot_path)
    require(not _dual_image or independent and manifest.get('Edition') == 'Dual', 'Expected the independent dual image')
    require(image_path.stat().st_size == (256 if _dual_image or persistent else 128) * 1024 * 1024, "Unexpected C# image size for the selected profile")
    if persistent: require(manifest.get('UsbWorkspace') is True, 'The persistent USB profile requires a workspace-enabled single-system image')
    if persistent:
        require(manifest.get('Resolution') == '0x0',
                'Physical USB delivery requires automatic firmware/monitor resolution; fixed QEMU test modes must not be deployed')
    inspected, files = inspect_image(image_path)
    single_proof = None
    if independent and not _dual_image:
        single_proof = verify_single_edition(inspected, files, manifest)
        require(boot.get('SingleEditionImageProof') == single_proof and boot.get('BootEntry') is None,
                'Boot acceptance must verify this exact single-system image with no menu selection')
    verify_elf(files["System/Kernel.elf"])
    verify_efi(files["EFI/BOOT/BOOTX64.EFI"], "EFI/BOOT/BOOTX64.EFI")
    verify_efi(files["EFI/XFE/Limine.efi"], "EFI/XFE/Limine.efi")
    raw = image_path.read_bytes()
    last = len(raw) // 512 - 1
    require(raw[462:510] == bytes(48), "Hybrid MBR refused")
    require(struct.unpack_from("<II", raw, 454) == (1, last), "Protective MBR geometry mismatch")
    require(struct.unpack_from("<I", raw, 512 + 20)[0] == 0, "Reserved GPT header field is nonzero")
    require(struct.unpack_from("<I", raw, last * 512 + 20)[0] == 0, "Backup GPT reserved field is nonzero")
    require(raw[512 + 56:512 + 72] == raw[last * 512 + 56:last * 512 + 72] != bytes(16), "GPT disk identities differ")
    table = raw[1024:1024 + 16384]
    require(table[128:] == bytes(16384 - 128), "Experimental profile requires exactly one ESP")
    expected_partition = uuid.UUID(manifest['BootPartitionGuid']).bytes_le if persistent else bytes.fromhex("00480deec13cd04e8ed0584645535953")
    require(table[16:32] == expected_partition, "Unexpected ESP identity")
    require(struct.unpack_from("<QQQ", table, 32) == (2048, last - 33, 0), "ESP bounds or attributes mismatch")
    require(table[56:128].decode("utf-16-le").rstrip("\0") == "XFESystem EFI", "ESP name mismatch")
    image_hash = inspected["ImageSha256"]
    kernel_hash = inspected["Files"]["System/Kernel.elf"]
    require(manifest.get("Kind") == "CSharpGptFat32Image", "Unexpected image build receipt")
    require(manifest.get("ImageBytes") == len(raw) and manifest.get("ImageSha256") == image_hash,
            "Image build receipt hash/length mismatch")
    require(manifest.get("KernelLanguage") == "C# NativeAOT" and manifest.get("FullImageReadback") is True,
            "Image was not verified as a C# native build")
    require(manifest.get("KernelSha256") == kernel_hash, "Image build receipt kernel mismatch")
    require(manifest.get("BootloaderSha256") == inspected["Files"]["EFI/BOOT/BOOTX64.EFI"] and
            manifest.get("ChainloaderSha256") == inspected["Files"]["EFI/XFE/Limine.efi"], "EFI build receipt mismatch")
    expected_kind = "XfeIndependentKernelBootProof" if independent else "BareMetalNativeAotBootProof"
    require(boot.get("Kind") == expected_kind and boot.get("Passed") is True and
            boot.get("ImageUnchanged") is True and type(boot.get("QemuExitCode")) is int and boot["QemuExitCode"] == 0,
            "A passing, cleaned-up native boot receipt is required")
    require(boot.get("ImageSha256") == image_hash and boot.get("KernelSha256") == kernel_hash,
            "Boot receipt does not bind this exact image/kernel")
    require(boot.get("BootShimSha256") == inspected["Files"]["EFI/BOOT/BOOTX64.EFI"], "Boot EFI hash mismatch")
    require(boot.get("ImageVerification", {}).get("Files") == inspected["Files"], "Boot image inventory mismatch")
    snapshot_path = Path(boot["SourceSnapshotPath"])
    if not snapshot_path.is_absolute():
        snapshot_path = boot_path.parent / snapshot_path
    snapshot_path = snapshot_path.resolve()
    snapshot, snapshot_hash = read_bound_json(snapshot_path)
    require(snapshot_hash == boot.get("SourceSnapshotSha256"), "Compiled source snapshot hash mismatch")
    kernel_source = "Source/XFESystem.NativeKernel/Kernel.cs" if independent else "Source/XFESystem.Kernel/Kernel.cs"
    require(isinstance(snapshot, dict) and kernel_source in snapshot,
            "Compiled source snapshot is incomplete")
    for name, expected in inspected["BootShimSourceSha256"].items():
        require(snapshot.get(name) == expected, "EFI source differs from the compiled source snapshot: " + name)
    ram_only = verify_independent_ram_profile(snapshot, manifest, boot) if independent else verify_ram_only_project(snapshot)
    edition = 'Console' if manifest.get('Edition') == 'Console' else 'Desktop'
    delivery = verify_independent_delivery(image_path, boot_path, snapshot, image_hash, boot_hash, edition) if independent else None
    storage_locks = []
    if persistent:
        proof_path = Path(boot['UsbStorageProof']['Path']).resolve()
        proof, proof_hash = read_bound_json(proof_path)
        require(proof_hash == boot['UsbStorageProof']['Sha256'], 'USB storage proof changed after delivery verification')
        storage_locks.append({'Path': str(proof_path), 'Sha256': proof_hash})
        for item in proof['EvidenceFiles']:
            path = (proof_path.parent / item['Path']).resolve()
            require(path.is_relative_to(proof_path.parent) and digest(path) == item['Sha256'], 'USB cold-boot evidence changed')
            storage_locks.append({'Path': str(path), 'Sha256': item['Sha256']})
        for relative, expected in delivery['EvidenceHarnessSha256'].items():
            storage_locks.append({'Path': str(ROOT / relative), 'Sha256': expected})
        storage_locks.append({'Path': delivery['LauncherPath'], 'Sha256': delivery['LauncherSha256']})
        if boot.get('MultiDisplayAcceptanceRequired') is True:
            display_path = Path(boot['MultiDisplayProof']['Path']).resolve()
            display_proof, display_hash = read_bound_json(display_path)
            require(display_hash == boot['MultiDisplayProof']['Sha256'] and display_proof['Passed'], 'Display proof changed after delivery verification')
            storage_locks.append({'Path': str(display_path), 'Sha256': display_hash})
            for item in display_proof['EvidenceFiles']:
                path = (display_path.parent / item['Path']).resolve()
                require(path.is_relative_to(display_path.parent) and digest(path) == item['Sha256'], 'Independent display evidence changed')
                storage_locks.append({'Path': str(path), 'Sha256': item['Sha256']})
    return {"Kind": "XfeCSharpExperimentalPhysicalMediaEvidence", "Profile": profile,
            "Architecture": "x86_64", "ImagePath": str(image_path), "ImageBytes": len(raw), "ImageSha256": image_hash,
            "KernelSha256": kernel_hash, "BootResultPath": str(boot_path), "BootResultSha256": boot_hash,
            "ImageManifestPath": str(manifest_path), "ImageManifestSha256": manifest_hash,
            "SourceSnapshotPath": str(snapshot_path), "SourceSnapshotSha256": snapshot_hash,
            **ram_only,
            **({"IndependentFinalDeliveryGate": delivery} if independent else {}),
            **({'SingleEditionImageProof': single_proof, 'Edition': edition} if single_proof else {}),
            **({'WorkspaceFirstLba': manifest['WorkspaceFirstLba'], 'WorkspaceBytes': manifest['WorkspaceBytes'],
                'UsbStorageProof': boot['UsbStorageProof'], 'UsbStorageAcceptancePassed': True,
                'DefaultImportSha256': inspected['Files']['UserFiles/UsbHello.dll'],
                'AdditionalEvidenceLocks': storage_locks} if persistent else {}),
            "IndependentImageInspection": inspected, "FullReleaseQualified": False, "StabilityPassed": False,
            "StabilityStatus": "Strict stability acceptance has not passed; investigation remains open",
            "CudaExecutionVerified": False, "GpuRasterizationVerified": False,
            "Purpose": "User-authorized experimental physical boot test; not a release or stability acceptance"}


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("image")
    parser.add_argument("boot_result")
    parser.add_argument("--profile", choices=("CSharpExperimental128", "IndependentCSharp128", "IndependentCSharpUsb256", "IndependentDualCSharp256"), default="CSharpExperimental128")
    arguments = parser.parse_args()
    try:
        print(json.dumps(verify(arguments.image, arguments.boot_result, arguments.profile), ensure_ascii=True))
    except Exception as error:
        print(str(error), file=sys.stderr)
        raise SystemExit(1)