wt
07c9967d02
Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged. Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending. Task: S00-019 Agent: auto-crypto-c68801170fa4 Role: crypto Action: claim Status: review Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
55 lines
2.8 KiB
Python
55 lines
2.8 KiB
Python
"""Verify exact installed pins/notices, immutable vendor files and browser graph."""
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
|
|
root = Path(__file__).resolve().parent
|
|
lock = json.loads((root / 'package-lock.json').read_text())
|
|
manifest = json.loads((root / 'package.json').read_text())
|
|
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
|
|
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
|
|
installed = 0
|
|
for section in ['dependencies', 'devDependencies']:
|
|
for name, version in manifest[section].items():
|
|
assert lock['packages']['node_modules/' + name]['version'] == version
|
|
for path, entry in lock['packages'].items():
|
|
if not path:
|
|
continue
|
|
name = path.split('node_modules/')[-1]
|
|
assert entry['resolved'].startswith('https://registry.npmjs.org/')
|
|
assert entry['integrity'].startswith('sha512-')
|
|
assert f"| {name} | {entry['version']} | {entry['license']} |" in inventory
|
|
package = root / path
|
|
if not package.exists():
|
|
assert entry.get('optional'), name
|
|
continue
|
|
meta = json.loads((package / 'package.json').read_text())
|
|
assert meta['version'] == entry['version'], name
|
|
assert meta['license'] == entry['license'], name
|
|
licenses = [f for f in package.iterdir() if f.is_file() and
|
|
('license' in f.name.lower() or f.name.lower().startswith(('copying', 'notice')))]
|
|
if name == '@rolldown/binding-darwin-arm64':
|
|
assert not licenses
|
|
licenses = [root / 'node_modules/rolldown/LICENSE',
|
|
root / 'node_modules/rolldown/THIRD-PARTY-LICENSE']
|
|
assert licenses, name
|
|
for file in licenses:
|
|
assert file.read_text().rstrip() in notices, file
|
|
installed += 1
|
|
# Parent is read-only evidence of unmodified pinned candidate, not a dependency.
|
|
original = root.parent / 'node_modules/stanza'
|
|
current = root / 'node_modules/stanza'
|
|
files = [f for f in current.rglob('*') if f.is_file()]
|
|
assert {f.relative_to(current) for f in files} == {
|
|
f.relative_to(original) for f in original.rglob('*') if f.is_file()}
|
|
for file in files:
|
|
assert file.read_bytes() == (original / file.relative_to(current)).read_bytes(), file
|
|
modules = json.loads((root / 'dist/modules.json').read_text())
|
|
assert any(x.endswith('/stanza/platform/browser/crypto/Hmac.js') for x in modules)
|
|
assert not any('/platform/node/' in x or x.startswith('node:') or 'browser-external' in x for x in modules)
|
|
print(f"{len(lock['packages']) - 1} locked entries; {installed} installed licenses/pins; "
|
|
f"{len(files)} unchanged Stanza files; browser backend confirmed")
|
|
for name in ['package-lock.json', 'sha512-mechanism.mjs', 'validated-sasl.mjs',
|
|
'test/scramp-vectors.json', 'dist/browser.mjs', 'dist/modules.json']:
|
|
print(name, hashlib.sha256((root / name).read_bytes()).hexdigest())
|