`nx_pkg_gate.nx` source

↩ module page · 494 lines · 27328 B
1// nx_pkg_gate.nx -- THE GATE FOR THE CONTENT-ADDRESSED PACKAGE LANE (LR3 of /compare/lang).
2//
3// Subject: the DEPLOYED nx_pkg binary (fork-style end-to-end; argv[1] overrides the subject path so a
4// mutation bite can aim at a staged mutant without touching live). Every fixture is assembled AT
5// RUNTIME in /tmp/nx_pkg_gate/ -- nothing is checked in, so a source scanner can never find this gate's
6// own bad inputs, and setup is idempotent so a rerun cannot inherit a prior run's artifacts.
7//
8// WHAT IT PROVES, AND WHY EACH TOOTH EXISTS:
9//   A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST. So every refusal tooth here is paired
10//   with a POSITIVE CONTROL that MUST be allowed, and every refusal asserts WHICH RULE FIRED -- both
11//   the rule name on stdout and the distinct exit code. A suite that only asks `was it refused?` is
12//   blind by construction, and this estate has already shipped that exact defect once (four SSRF deny
13//   tests green while the guard refused every url).
14//
15//   ZERO INSTALL-TIME EXECUTION is proven MECHANICALLY, never asserted. The module fixture carries a
16//   real would-be install hook, and the gate first RUNS that hook itself to prove it genuinely produces
17//   an observable marker (the anti-vacuity control -- otherwise `the marker is absent` proves only that
18//   the marker was never producible). The marker is then cleared, the same module resolved through the
19//   subject, and the marker asserted ABSENT while the resolve itself SUCCEEDED.
20//
21// NOT ROSTER-ADMITTED BY DEFAULT: it forks the subject ~25 times. Run via nx_job_run or /api/gate_run.
22// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
23import "nx_syscalls.nx"
24import "nx_gate_verdict.nx"
25import "nx_sha256.nx"
26
27const PG_SUBJECT_DEFAULT: *u8 = "./nx_pkg.elf" as *u8
28const PG_DIR: *u8 = "/tmp/nx_pkg_gate" as *u8
29const PG_STORE: *u8 = "/tmp/nx_pkg_gate/store" as *u8
30const PG_CONF: *u8 = "/tmp/nx_pkg_gate/pkg_cas.conf" as *u8
31const PG_CONF_BAD: *u8 = "/tmp/nx_pkg_gate/bad_missing_key.conf" as *u8
32const PG_LOCK: *u8 = "/tmp/nx_pkg_gate/pkg.lock" as *u8
33const PG_JRNL: *u8 = "/tmp/nx_pkg_gate/pkgcas.jrnl" as *u8
34const PG_OUT: *u8 = "/tmp/nx_pkg_gate/capture.txt" as *u8
35const PG_MOD_HOOK: *u8 = "/tmp/nx_pkg_gate/mod_with_install_hook.nx" as *u8
36const PG_MOD_SQUAT: *u8 = "/tmp/nx_pkg_gate/mod_typosquat.nx" as *u8
37const PG_PWN_CONF: *u8 = "/tmp/nx_pkg_gate/pwn_conf.conf" as *u8
38const PG_PWN_PAYLOAD: *u8 = "/tmp/nx_pkg_gate/pwn_payload.txt" as *u8
39const PG_PWN_MARKER: *u8 = "/tmp/nx_pkg_gate/PWNED" as *u8
40const PG_PWN_LOCK: *u8 = "/tmp/nx_pkg_gate/pwn.lock" as *u8
41const PG_PWN_STORE: *u8 = "/tmp/nx_pkg_gate/pwnstore" as *u8
42const PG_DEST_OK: *u8 = "/tmp/nx_pkg_gate/resolved_hook.nx" as *u8
43const PG_DEST_GOOD: *u8 = "/tmp/nx_pkg_gate/resolved_pinned.nx" as *u8
44const PG_DEST_SQUAT: *u8 = "/tmp/nx_pkg_gate/resolved_squat.nx" as *u8
45const PG_DEST_MISMATCH: *u8 = "/tmp/nx_pkg_gate/resolved_mismatch.nx" as *u8
46const PG_DEST_OUTSIDE: *u8 = "/etc/nx_pkg_gate_should_never_appear" as *u8
47// the legitimate logical name, and the lookalike an attacker would publish beside it
48const PG_NAME_REAL: *u8 = "nx_syscalls" as *u8
49const PG_NAME_SQUAT: *u8 = "nx_sysca11s" as *u8
50
51const PG_SHAHEX: i64 = 64
52const PG_DIGEST_BYTES: i64 = 32
53const PG_NL: i64 = 10
54const PG_BAR: i64 = 124
55const PG_ASCII_0: i64 = 48
56const PG_ASCII_9: i64 = 57
57const PG_SCRATCH: i64 = 4096
58const PG_MODE_X: i64 = 493
59// distinct exit codes the subject promises; asserted individually so a refusal for the WRONG reason
60// cannot score as a pass (a red for the wrong reason is not evidence)
61const PG_EXIT_USAGE: i64 = 3
62const PG_EXIT_CONF: i64 = 4
63const PG_EXIT_MALFORMED: i64 = 5
64const PG_EXIT_ABSENT: i64 = 6
65const PG_EXIT_MISMATCH: i64 = 7
66const PG_EXIT_DEST: i64 = 8
67const PG_EXIT_NOTPINNED: i64 = 9
68const PG_EXIT_PINCONFLICT: i64 = 10
69const PG_EXIT_CHAIN: i64 = 11
70const PG_EXIT_PINAMBIG: i64 = 13
71
72func pg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
73func pg_mkdir(path: *u8) -> i64 {
  let nbox: *i64 = sys_mmap(16) as *i64
  nbox[0] = 258
  let rc: i64 = __syscall(nbox[0], 0 - 100, path as i64, 0x1ed, 0, 0, 0)
  sys_munmap(nbox as *u8, 16)
  return rc
79}
80func pg_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
81func pg_cat(d: *u8, o: i64, s: *u8) -> i64 { var p: i64 = o; var i: i64 = 0; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } d[p] = 0 as u8; return p }
82func pg_write(path: *u8, buf: *u8, n: i64) -> i64 {
  let fd: i64 = sys_openat_wr(path, MODE_0644)
  if fd < 0 { return 0 - 1 }
  var w: i64 = 0
  while w < n {
      let r: i64 = sys_write(fd, ((buf as i64) + w) as *u8, n - w)
      if r <= 0 { sys_close(fd); return 0 - 1 }
      w = w + r
  }
  sys_close(fd)
  return n
93}
94func pg_write_str(path: *u8, s: *u8) -> i64 { return pg_write(path, s, pg_slen(s)) }
95func pg_find(hay: *u8, n: i64, needle: *u8) -> i64 {
  let m: i64 = pg_slen(needle)
  if m == 0 { return 0 - 1 }
  var i: i64 = 0
  while i + m <= n {
      var j: i64 = 0
      var ok: i64 = 1
      while j < m { if hay[i + j] != needle[j] { ok = 0; j = m } else { j = j + 1 } }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
107}
108func pg_num_after(hay: *u8, n: i64, key: *u8) -> i64 {
  let at: i64 = pg_find(hay, n, key)
  if at < 0 { return 0 - 1 }
  var i: i64 = at + pg_slen(key)
  var v: i64 = 0
  var seen: i64 = 0
  while i < n {
      let c: i64 = hay[i] as i64
      if c < PG_ASCII_0 { break }
      if c > PG_ASCII_9 { break }
      v = v * 10 + (c - PG_ASCII_0)
      seen = 1
      i = i + 1
  }
  if seen == 0 { return 0 - 1 }
  return v
124}
125func pg_hex_into(dig: *u8, out: *u8) -> i64 {
  let h: *u8 = "0123456789abcdef" as *u8
  var i: i64 = 0
  while i < PG_DIGEST_BYTES { let v: i64 = dig[i] as i64; out[i*2] = h[(v >> 4) & 15]; out[i*2+1] = h[v & 15]; i = i + 1 }
  out[PG_SHAHEX] = 0 as u8
  return PG_SHAHEX
131}
132// independent digest of a file ON DISK -- the gate hashes the RESULT itself rather than believing the
133// subject's own receipt. Returns byte count, or -1 when absent.
134func pg_file_sha(path: *u8, outhex: *u8) -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(path, lp)
  if (b as i64) == 0 { outhex[0] = 0 as u8; return 0 - 1 }
  let d: *u8 = sys_mmap(PG_DIGEST_BYTES + 8)
  sha256_digest(b, lp[0], d)
  pg_hex_into(d, outhex)
  let n: i64 = lp[0]
  sys_free_file(b, n)
  return n
144}
145// fork the subject with up to 4 args; stdout+stderr captured to PG_OUT; returns the exit code
146func pg_run(subject: *u8, a1: *u8, a2: *u8, a3: *u8, a4: *u8, nargs: i64) -> i64 {
  let arr: *i64 = sys_mmap(64) as *i64
  arr[0] = subject as i64
  if nargs >= 1 { arr[1] = a1 as i64 }
  if nargs >= 2 { arr[2] = a2 as i64 }
  if nargs >= 3 { arr[3] = a3 as i64 }
  if nargs >= 4 { arr[4] = a4 as i64 }
  arr[nargs + 1] = 0
  let env: *i64 = sys_mmap(16) as *i64
  env[0] = 0
  let pid: i64 = sys_fork()
  if pid == 0 {
      let fd: i64 = sys_openat_wr(PG_OUT, MODE_0644)
      if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) }
      sys_execve(subject, arr, env)
      sys_exit(127)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, st, 0)
  return wait_status_rc(st[0])
166}
167func pg_read_out(lp: *i64) -> *u8 {
  let b: *u8 = sys_read_file(PG_OUT, lp)
  if (b as i64) == 0 { lp[0] = 0; return sys_mmap(16) }
  return b
171}
172// did the last capture name THIS rule? Both the rule name and the exit code are asserted by callers.
173func pg_saw_rule(rule: *u8) -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = pg_read_out(lp)
  let need: i64 = pg_slen(rule) + 8
  let pat: *u8 = sys_mmap(need)
  var o: i64 = pg_cat(pat, 0, "rule=" as *u8)
  o = pg_cat(pat, o, rule)
  var hit: i64 = 0
  if pg_find(b, lp[0], pat) >= 0 { hit = 1 }
  sys_munmap(pat, need)
  return hit
184}
185
186func main(argc: i64, argv: *i64) -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_pkg_gate -- content-addressed resolution, a typosquat that cannot resolve, and zero install-time execution proven by an absent side effect" as *u8)
  var subject: *u8 = PG_SUBJECT_DEFAULT
  if argc >= 2 { subject = argv[1] as *u8 }
  gv_puts("  subject: " as *u8); gv_puts(subject); gv_puts("\n" as *u8)
192
  // ---- SETUP: idempotent, runtime-assembled ---------------------------------------------------
  pg_mkdir(PG_DIR)
  pg_mkdir(PG_STORE)
  sys_unlinkat(PG_LOCK)
  sys_unlinkat(PG_JRNL)
  sys_unlinkat(PG_PWN_MARKER)
  sys_unlinkat(PG_PWN_LOCK)
  sys_unlinkat(PG_DEST_OK)
  sys_unlinkat(PG_DEST_GOOD)
  sys_unlinkat(PG_DEST_SQUAT)
  sys_unlinkat(PG_DEST_MISMATCH)
  sys_unlinkat(PG_DEST_OUTSIDE)
205
  let cbuf: *u8 = sys_mmap(PG_SCRATCH)
  var co: i64 = pg_cat(cbuf, 0, "store_root=" as *u8)
  co = pg_cat(cbuf, co, PG_STORE)
  co = pg_cat(cbuf, co, "\nlock_path=" as *u8)
  co = pg_cat(cbuf, co, PG_LOCK)
  co = pg_cat(cbuf, co, "\nlog_path=" as *u8)
  co = pg_cat(cbuf, co, PG_JRNL)
  co = pg_cat(cbuf, co, "\n" as *u8)
  pg_write(PG_CONF, cbuf, co)
215
  // a conf missing log_path -- an absent key must REFUSE, never default
  var bo: i64 = pg_cat(cbuf, 0, "store_root=" as *u8)
  bo = pg_cat(cbuf, bo, PG_STORE)
  bo = pg_cat(cbuf, bo, "\nlock_path=" as *u8)
  bo = pg_cat(cbuf, bo, PG_LOCK)
  bo = pg_cat(cbuf, bo, "\n" as *u8)
  pg_write(PG_CONF_BAD, cbuf, bo)
223
  // the would-be install hook: a SEPARATE conf whose journal path IS the marker, so running the hook
  // command creates exactly one observable file that a single probe can settle.
  var po: i64 = pg_cat(cbuf, 0, "store_root=" as *u8)
  po = pg_cat(cbuf, po, PG_PWN_STORE)
  po = pg_cat(cbuf, po, "\nlock_path=" as *u8)
  po = pg_cat(cbuf, po, PG_PWN_LOCK)
  po = pg_cat(cbuf, po, "\nlog_path=" as *u8)
  po = pg_cat(cbuf, po, PG_PWN_MARKER)
  po = pg_cat(cbuf, po, "\n" as *u8)
  pg_write(PG_PWN_CONF, cbuf, po)
  pg_write_str(PG_PWN_PAYLOAD, "payload bytes the hook would install\n" as *u8)
  pg_mkdir(PG_PWN_STORE)
236
  // THE MODULE UNDER TEST: ordinary-looking source that carries a live install hook in its body.
  var mo: i64 = pg_cat(cbuf, 0, "// module fixture: this file carries a WORKING install hook\npostinstall=" as *u8)
  mo = pg_cat(cbuf, mo, subject)
  mo = pg_cat(cbuf, mo, " cas_put " as *u8)
  mo = pg_cat(cbuf, mo, PG_PWN_PAYLOAD)
  mo = pg_cat(cbuf, mo, " " as *u8)
  mo = pg_cat(cbuf, mo, PG_PWN_CONF)
  mo = pg_cat(cbuf, mo, "\nfunc hookmod_id() -> i64 { return 1 }\n" as *u8)
  pg_write(PG_MOD_HOOK, cbuf, mo)
  let hooklen: i64 = mo
247
  // the typosquat's payload: different bytes, same intent to be mistaken for the real module
  pg_write_str(PG_MOD_SQUAT, "// TYPOSQUAT: lookalike name, attacker-chosen bytes\nfunc syscalls_init() -> i64 { return 0 - 1 }\n" as *u8)
250
  let lp: *i64 = sys_mmap(16) as *i64
  var rc: i64 = 0
  var ob: *u8 = sys_mmap(16)
  var onn: i64 = 0
255
  // the population this run actually examined: two distinct modules through the whole lane
  gv_subjects("modules driven end-to-end through the CAS lane" as *u8, 2, ctr)
258
  // ---- T1 the fixture genuinely contains a live install hook ------------------------------------
  let hb: *u8 = sys_read_file(PG_MOD_HOOK, lp)
  var t1: i64 = 0
  if (hb as i64) != 0 { if pg_find(hb, lp[0], "postinstall=" as *u8) >= 0 { if lp[0] == hooklen { t1 = 1 } } }
  gv_puts("  fixture module bytes=" as *u8); gv_num(hooklen); gv_puts("\n" as *u8)
  gv_check("fixture-module-really-carries-an-install-hook-line (the condition, asserted before any outcome)" as *u8, t1 == 1, ctr)
265
  // ---- T2 ANTI-VACUITY: the hook is genuinely executable and produces the marker ----------------
  // Without this, `the marker is absent` would prove only that the marker was never producible.
  sys_unlinkat(PG_PWN_MARKER)
  let before_hook: i64 = pg_exists(PG_PWN_MARKER)
  pg_run(subject, "cas_put" as *u8, PG_PWN_PAYLOAD, PG_PWN_CONF, 0 as *u8, 3)
  let after_hook: i64 = pg_exists(PG_PWN_MARKER)
  gv_puts("  hook control: marker before=" as *u8); gv_num(before_hook)
  gv_puts(" after_running_the_hook=" as *u8); gv_num(after_hook); gv_puts("\n" as *u8)
  gv_bite("neg-control-the-planted-install-hook-DOES-fire-when-executed (bad=marker appears, good=absent after reset)" as *u8, after_hook, before_hook, ctr)
275
  // reset, and PROVE the reset landed before measuring the thing under test
  sys_unlinkat(PG_PWN_MARKER)
  gv_check("marker-cleared-before-the-resolve-under-test (a stale marker would make the next tooth lie)" as *u8, pg_exists(PG_PWN_MARKER) == 0, ctr)
279
  // ---- T3 put the hook-carrying module into the store ------------------------------------------
  rc = pg_run(subject, "cas_put" as *u8, PG_MOD_HOOK, PG_CONF, 0 as *u8, 3)
  ob = pg_read_out(lp); onn = lp[0]
  let dig_hook: *u8 = sys_mmap(PG_SHAHEX + 8)
  var dh: i64 = pg_find(ob, onn, "digest=" as *u8)
  var t3: i64 = 0
  if rc == 0 { if dh >= 0 {
      var i: i64 = 0
      while i < PG_SHAHEX { dig_hook[i] = ob[dh + 7 + i]; i = i + 1 }
      dig_hook[PG_SHAHEX] = 0 as u8
      t3 = 1
  } }
  // the gate re-derives the digest itself: the subject's receipt is never the oracle
  let own_hook: *u8 = sys_mmap(PG_SHAHEX + 8)
  let ownn: i64 = pg_file_sha(PG_MOD_HOOK, own_hook)
  var t3b: i64 = 0
  if t3 == 1 { if ownn == hooklen { var same: i64 = 1; var i2: i64 = 0; while i2 < PG_SHAHEX { if dig_hook[i2] != own_hook[i2] { same = 0; i2 = PG_SHAHEX } else { i2 = i2 + 1 } } t3b = same } }
  gv_puts("  cas_put rc=" as *u8); gv_num(rc); gv_puts(" digest=" as *u8); gv_puts(dig_hook); gv_puts("\n" as *u8)
  gv_check("cas-put-digest-equals-the-gate-s-own-independent-sha256-of-the-file (not the subject's receipt)" as *u8, t3b == 1, ctr)
299
  // ---- T4 THE CENTRAL CLAIM: resolve SUCCEEDS and executes nothing ------------------------------
  rc = pg_run(subject, "cas_resolve" as *u8, dig_hook, PG_DEST_OK, PG_CONF, 4)
  let marker_after_resolve: i64 = pg_exists(PG_PWN_MARKER)
  let resolved_present: i64 = pg_exists(PG_DEST_OK)
  gv_puts("  cas_resolve rc=" as *u8); gv_num(rc)
  gv_puts(" dest_present=" as *u8); gv_num(resolved_present)
  gv_puts(" install_marker_present=" as *u8); gv_num(marker_after_resolve); gv_puts("\n" as *u8)
  var t4: i64 = 0
  if rc == 0 { if resolved_present == 1 { if marker_after_resolve == 0 { t4 = 1 } } }
  gv_check("ZERO-INSTALL-EXECUTION: a hook-carrying module RESOLVES SUCCESSFULLY and the hook's side effect is absent (rc, dest and marker all bound in the condition)" as *u8, t4 == 1, ctr)
310
  // ---- T5 the resolved bytes hash to the digest that was ASKED FOR ------------------------------
  let got: *u8 = sys_mmap(PG_SHAHEX + 8)
  let gotn: i64 = pg_file_sha(PG_DEST_OK, got)
  var t5: i64 = 0
  if gotn == hooklen { var same2: i64 = 1; var i3: i64 = 0; while i3 < PG_SHAHEX { if got[i3] != dig_hook[i3] { same2 = 0; i3 = PG_SHAHEX } else { i3 = i3 + 1 } } t5 = same2 }
  gv_puts("  resolved bytes=" as *u8); gv_num(gotn); gv_puts(" sha=" as *u8); gv_puts(got); gv_puts("\n" as *u8)
  gv_check("resolved-file-re-hashes-to-the-requested-digest (the STATE is the oracle, not the message)" as *u8, t5 == 1, ctr)
318
  // ---- T6 POSITIVE CONTROL: a legitimately pinned name RESOLVES ---------------------------------
  // Without this every refusal below is satisfied by a resolver that refuses everything.
  rc = pg_run(subject, "pin" as *u8, PG_NAME_REAL, dig_hook, PG_CONF, 4)
  let pin_rc: i64 = rc
  rc = pg_run(subject, "resolve" as *u8, PG_NAME_REAL, PG_DEST_GOOD, PG_CONF, 4)
  var t6: i64 = 0
  if pin_rc == 0 { if rc == 0 { if pg_exists(PG_DEST_GOOD) == 1 { t6 = 1 } } }
  gv_puts("  pin rc=" as *u8); gv_num(pin_rc); gv_puts(" resolve-by-name rc=" as *u8); gv_num(rc); gv_puts("\n" as *u8)
  gv_check("neg-control-POSITIVE: a legitimately pinned name RESOLVES (a resolver that refused everything would fail HERE)" as *u8, t6 == 1, ctr)
328
  // ---- T7 THE TYPOSQUAT: a lookalike name cannot resolve ----------------------------------------
  // The attacker even gets their bytes INTO the store first -- the squat still cannot be reached,
  // because resolution is exact-pin then digest, with no near-name search and no `latest`.
  pg_run(subject, "cas_put" as *u8, PG_MOD_SQUAT, PG_CONF, 0 as *u8, 3)
  rc = pg_run(subject, "resolve" as *u8, PG_NAME_SQUAT, PG_DEST_SQUAT, PG_CONF, 4)
  let squat_rule: i64 = pg_saw_rule("name-not-pinned" as *u8)
  let squat_file: i64 = pg_exists(PG_DEST_SQUAT)
  gv_puts("  typosquat rc=" as *u8); gv_num(rc)
  gv_puts(" named_rule=" as *u8); gv_num(squat_rule)
  gv_puts(" wrote_a_file=" as *u8); gv_num(squat_file); gv_puts("\n" as *u8)
  var t7: i64 = 0
  if rc == PG_EXIT_NOTPINNED { if squat_rule == 1 { if squat_file == 0 { t7 = 1 } } }
  gv_check("TYPOSQUAT-CANNOT-RESOLVE: a lookalike name refuses with rule=name-not-pinned, the named exit code, and writes NO file" as *u8, t7 == 1, ctr)
342
  // ---- T8 A POISONED STORE serves a refusal, never different code -------------------------------
  // Overwrite the blob AT the legitimate digest with the typosquat's bytes. The path is a hint; the
  // hash is the identity. Bite-proven in both directions: poisoned refuses, restored resolves.
  let bp: *u8 = sys_mmap(PG_SCRATCH)
  var bpo: i64 = pg_cat(bp, 0, PG_STORE)
  bpo = pg_cat(bp, bpo, "/" as *u8)
  bpo = pg_cat(bp, bpo, dig_hook)
  let orig: *u8 = sys_read_file(bp, lp)
  let orign: i64 = lp[0]
  pg_write_str(bp, "ATTACKER BYTES SUBSTITUTED AT THE LEGITIMATE DIGEST PATH\n" as *u8)
  rc = pg_run(subject, "cas_resolve" as *u8, dig_hook, PG_DEST_MISMATCH, PG_CONF, 4)
  let mm_rule: i64 = pg_saw_rule("digest-mismatch" as *u8)
  let mm_file: i64 = pg_exists(PG_DEST_MISMATCH)
  var poisoned_refused: i64 = 0
  if rc == PG_EXIT_MISMATCH { if mm_rule == 1 { if mm_file == 0 { poisoned_refused = 1 } } }
  pg_write(bp, orig, orign)
  sys_unlinkat(PG_DEST_MISMATCH)
  let rc_restored: i64 = pg_run(subject, "cas_resolve" as *u8, dig_hook, PG_DEST_MISMATCH, PG_CONF, 4)
  var restored_ok: i64 = 1
  if rc_restored == 0 { restored_ok = 0 }
  gv_puts("  poisoned rc=" as *u8); gv_num(rc)
  gv_puts(" restored rc=" as *u8); gv_num(rc_restored); gv_puts("\n" as *u8)
  gv_bite("neg-control-THE-PATH-IS-A-HINT-THE-HASH-IS-THE-IDENTITY: a substituted blob refuses digest-mismatch, the restored blob resolves" as *u8, poisoned_refused, restored_ok, ctr)
366
  // ---- T9 an unparseable digest fails CLOSED ----------------------------------------------------
  let short_dig: *u8 = sys_mmap(PG_SHAHEX + 8)
  var si: i64 = 0
  while si < PG_SHAHEX - 1 { short_dig[si] = dig_hook[si]; si = si + 1 }
  short_dig[PG_SHAHEX - 1] = 0 as u8
  let rc_short: i64 = pg_run(subject, "cas_resolve" as *u8, short_dig, PG_DEST_SQUAT, PG_CONF, 4)
  let r_short: i64 = pg_saw_rule("malformed-digest" as *u8)
  let rc_nonhex: i64 = pg_run(subject, "cas_resolve" as *u8, "zzzz611184eed3163d3ff8b059045c777b2c3fad3a6db3b8b5a5128c45504ca9" as *u8, PG_DEST_SQUAT, PG_CONF, 4)
  let r_nonhex: i64 = pg_saw_rule("malformed-digest" as *u8)
  let rc_upper: i64 = pg_run(subject, "cas_resolve" as *u8, "2990611184EED3163D3FF8B059045C777B2C3FAD3A6DB3B8B5A5128C45504CA9" as *u8, PG_DEST_SQUAT, PG_CONF, 4)
  let r_upper: i64 = pg_saw_rule("malformed-digest" as *u8)
  var t9: i64 = 0
  if rc_short == PG_EXIT_MALFORMED { if rc_nonhex == PG_EXIT_MALFORMED { if rc_upper == PG_EXIT_MALFORMED {
      if r_short == 1 { if r_nonhex == 1 { if r_upper == 1 { if pg_exists(PG_DEST_SQUAT) == 0 { t9 = 1 } } } } } } }
  gv_puts("  malformed rc short=" as *u8); gv_num(rc_short)
  gv_puts(" nonhex=" as *u8); gv_num(rc_nonhex)
  gv_puts(" uppercase=" as *u8); gv_num(rc_upper); gv_puts("\n" as *u8)
  gv_check("UNPARSEABLE-INPUT-FAILS-CLOSED: short, non-hex and uppercase digests each refuse malformed-digest and write nothing" as *u8, t9 == 1, ctr)
385
  // ---- T10 an absent digest refuses -------------------------------------------------------------
  let rc_abs: i64 = pg_run(subject, "cas_resolve" as *u8, "0000000000000000000000000000000000000000000000000000000000000000" as *u8, PG_DEST_SQUAT, PG_CONF, 4)
  var t10: i64 = 0
  if rc_abs == PG_EXIT_ABSENT { if pg_saw_rule("digest-absent" as *u8) == 1 { if pg_exists(PG_DEST_SQUAT) == 0 { t10 = 1 } } }
  gv_check("absent-digest-refuses-rule=digest-absent-and-writes-nothing" as *u8, t10 == 1, ctr)
391
  // ---- T11 a destination outside the allowlist refuses ------------------------------------------
  let rc_dest: i64 = pg_run(subject, "cas_resolve" as *u8, dig_hook, PG_DEST_OUTSIDE, PG_CONF, 4)
  var t11: i64 = 0
  if rc_dest == PG_EXIT_DEST { if pg_saw_rule("dest-refused" as *u8) == 1 { if pg_exists(PG_DEST_OUTSIDE) == 0 { t11 = 1 } } }
  gv_check("dest-outside-the-safe-root-allowlist-refuses-rule=dest-refused-and-creates-no-file" as *u8, t11 == 1, ctr)
397
  // ---- T12 an unrecognised verb refuses, it does not fall through -------------------------------
  let rc_verb: i64 = pg_run(subject, "cas_reslove" as *u8, dig_hook, PG_DEST_SQUAT, PG_CONF, 4)
  let verb_rule: i64 = pg_saw_rule("unknown-verb" as *u8)
  var t12: i64 = 0
  if rc_verb == PG_EXIT_USAGE { if verb_rule == 1 { if pg_exists(PG_DEST_SQUAT) == 0 { t12 = 1 } } }
  gv_puts("  unknown verb rc=" as *u8); gv_num(rc_verb); gv_puts(" named_rule=" as *u8); gv_num(verb_rule); gv_puts("\n" as *u8)
  gv_check("UNKNOWN-VERB-FAILS-CLOSED naming rule=unknown-verb (a typo must not report as a CONFIGURATION fault -- the refusal names the conjunct that fired)" as *u8, t12 == 1, ctr)
405
  // ---- T13 an absent conf key refuses, it does not default -------------------------------------
  let rc_conf: i64 = pg_run(subject, "cas_resolve" as *u8, dig_hook, PG_DEST_SQUAT, PG_CONF_BAD, 4)
  var t13: i64 = 0
  if rc_conf == PG_EXIT_CONF { if pg_saw_rule("conf-missing-key" as *u8) == 1 { if pg_exists(PG_DEST_SQUAT) == 0 { t13 = 1 } } }
  gv_check("absent-conf-key-refuses-rule=conf-missing-key (config is data; a missing row never silently defaults)" as *u8, t13 == 1, ctr)
411
  // ---- T14 pin conflict and pin ambiguity both refuse -------------------------------------------
  let squat_dig: *u8 = sys_mmap(PG_SHAHEX + 8)
  pg_file_sha(PG_MOD_SQUAT, squat_dig)
  let rc_conflict: i64 = pg_run(subject, "pin" as *u8, PG_NAME_REAL, squat_dig, PG_CONF, 4)
  var t14: i64 = 0
  if rc_conflict == PG_EXIT_PINCONFLICT { if pg_saw_rule("pin-conflict" as *u8) == 1 { t14 = 1 } }
  gv_puts("  re-pin to a different digest rc=" as *u8); gv_num(rc_conflict); gv_puts("\n" as *u8)
  gv_check("re-pinning-a-name-to-a-DIFFERENT-digest-refuses-rule=pin-conflict (a pin is not silently movable)" as *u8, t14 == 1, ctr)
420
  // hand-append a duplicate row: a declaration file that permits two answers for one key is a coin
  // flip wearing a schema, so the reader must REFUSE rather than pick first-match or last-match.
  let dupfd: i64 = sys_openat_append(PG_LOCK, MODE_0644)
  if dupfd >= 0 {
      var duo: i64 = pg_cat(cbuf, 0, PG_NAME_REAL)
      cbuf[duo] = PG_BAR as u8; duo = duo + 1
      duo = pg_cat(cbuf, duo, squat_dig)
      cbuf[duo] = PG_NL as u8; duo = duo + 1
      sys_write(dupfd, cbuf, duo)
      sys_close(dupfd)
  }
  sys_unlinkat(PG_DEST_GOOD)
  let rc_ambig: i64 = pg_run(subject, "resolve" as *u8, PG_NAME_REAL, PG_DEST_GOOD, PG_CONF, 4)
  var t15: i64 = 0
  if rc_ambig == PG_EXIT_PINAMBIG { if pg_saw_rule("pin-ambiguous" as *u8) == 1 { if pg_exists(PG_DEST_GOOD) == 0 { t15 = 1 } } }
  gv_puts("  duplicate pin row rc=" as *u8); gv_num(rc_ambig); gv_puts("\n" as *u8)
  gv_check("DUPLICATE-PIN-ROW-REFUSES-rule=pin-ambiguous rather than choosing first-match or last-match" as *u8, t15 == 1, ctr)
438
  // ---- T16 the transparency journal verifies, and a tampered row breaks it ----------------------
  let rc_log: i64 = pg_run(subject, "logverify" as *u8, PG_CONF, 0 as *u8, 0 as *u8, 2)
  ob = pg_read_out(lp); onn = lp[0]
  let entries: i64 = pg_num_after(ob, onn, "entries=" as *u8)
  var t16: i64 = 0
  if rc_log == 0 { if entries > 0 { if pg_find(ob, onn, "chain=OK" as *u8) >= 0 { t16 = 1 } } }
  gv_puts("  journal entries=" as *u8); gv_num(entries); gv_puts(" logverify rc=" as *u8); gv_num(rc_log); gv_puts("\n" as *u8)
  gv_check("journal-chain-verifies-with-the-entry-count-BOUND-IN-THE-CONDITION (a zero-row journal cannot pass)" as *u8, t16 == 1, ctr)
447
  // tamper one byte inside row 0's digest field, then restore
  let jb: *u8 = sys_read_file(PG_JRNL, lp)
  let jn: i64 = lp[0]
  var tampered_break: i64 = 0
  var tampered_at: i64 = 0 - 1
  var append_refused: i64 = 0
  if (jb as i64) != 0 { if jn > 0 {
      let copy: *u8 = sys_mmap(jn + 16)
      var ci: i64 = 0
      while ci < jn { copy[ci] = jb[ci]; ci = ci + 1 }
      // second '|' of the first line starts the digest field
      var bars: i64 = 0
      var k: i64 = 0
      var digoff: i64 = 0 - 1
      while k < jn {
          if (copy[k] as i64) == PG_BAR { bars = bars + 1; if bars == 2 { digoff = k + 1; k = jn } }
          if (copy[k] as i64) == PG_NL { k = jn }
          k = k + 1
      }
      if digoff > 0 {
          let old: i64 = copy[digoff] as i64
          var nw: i64 = PG_ASCII_0
          if old == PG_ASCII_0 { nw = PG_ASCII_0 + 1 }
          copy[digoff] = nw as u8
          pg_write(PG_JRNL, copy, jn)
          let rc_t: i64 = pg_run(subject, "logverify" as *u8, PG_CONF, 0 as *u8, 0 as *u8, 2)
          ob = pg_read_out(lp); onn = lp[0]
          tampered_at = pg_num_after(ob, onn, "chain=BREAK at=" as *u8)
          if rc_t == PG_EXIT_CHAIN { if tampered_at == 0 { if pg_saw_rule("chain-break" as *u8) == 1 { tampered_break = 1 } } }
          // and an append onto a broken chain must REFUSE rather than extend it
          sys_unlinkat(PG_DEST_MISMATCH)
          let rc_ap: i64 = pg_run(subject, "cas_resolve" as *u8, dig_hook, PG_DEST_MISMATCH, PG_CONF, 4)
          if rc_ap == PG_EXIT_CHAIN { append_refused = 1 }
          // restore the banked bytes
          pg_write(PG_JRNL, jb, jn)
      }
  } }
  let rc_log2: i64 = pg_run(subject, "logverify" as *u8, PG_CONF, 0 as *u8, 0 as *u8, 2)
  var restored_log_bad: i64 = 1
  if rc_log2 == 0 { restored_log_bad = 0 }
  gv_puts("  tampered chain break_at=" as *u8); gv_num(tampered_at)
  gv_puts(" restored logverify rc=" as *u8); gv_num(rc_log2); gv_puts("\n" as *u8)
  gv_bite("neg-control-TAMPER-EVIDENCE: editing one byte of a past row breaks the chain AT THE NAMED INDEX, and the restored journal verifies" as *u8, tampered_break, restored_log_bad, ctr)
  gv_check("an-append-onto-a-BROKEN-chain-is-REFUSED-not-extended (you cannot grow a tampered journal)" as *u8, append_refused == 1, ctr)
492
  return gv_verdict("PKG-CAS" as *u8, ctr, "content-addressed resolution with no name lookup at the digest layer, an exact-pin lane whose unpinned names fail closed, and a hash-chained journal" as *u8)
494}
nx_pkg_gate.nx source

`nx_pkg_gate.nx` source
