nx_roku_cert_gate.nx source

1// nx_roku_cert_gate.nx -- SOVEREIGN liar-kill gate for Roku Channel-Store cert-readiness (R7 of the Roku media-app 2// arc). Drives the REAL grid emitter to a test path, then mechanically proves -- ENTIRELY within Nishi (no python, 3// no device) -- that the emitted channel meets every STATICALLY-checkable Roku Store hard cert bar, via our own 4// opc_read_part / raw-zip inspection: 5// C1 valid ZIP package (PK\x03\x04) 6// C2 package <= 4 MB (Roku hard package-size limit) 7// C3 `manifest` present at zip root 8// C4 manifest -> title= (required manifest key) 9// C5 manifest -> major/minor/build_version (required version triplet) 10// C6 manifest -> mm_icon_focus_hd (required channel focus icon) 11// C7 channel icon PNG present + valid signature 12// C8 on-device auth: NO external login webpage (Roku bars web-login redirects) 13// C9 deep-link entry contract: Main(args)+args.contentId+args.mediaType (Store deep-linking) 14// C10 video all-models H.264 baseline (every declared stream must play on ALL models; vacuous w/ no video) 15// + four LIAR-KILLS so the gate cannot false-green: an oversize package is rejected, a synthetic external-login 16// page is detected, an unknown part returns <0, and a deliberately NON-COMPLIANT channel (built here via 17// opc_write) fails the full cert evaluation (<10/10). 18// HONEST SCOPE: this proves the STATIC package + entry-point bars. The RUNTIME bars (launch<15s, video-start<8s, 19// back-button, on-TV deep-link routing) are DEVICE-verified and are printed as explicitly NOT covered. The 20// royalty-free-only (VP9/AV1) vs all-models-H.264 tension is printed as a DEFERRED risk for Track L (nx_counsel). 21// GREEN iff 14/14. Requires /tmp/nx_roku_grid_emit.sov.elf (build nx_roku_grid_emit first). 22// Durable knowledge/status/roku_cert_gate.log. license_tier: ORIGINAL 23import "nx_syscalls.nx" 24import "nx_opc.nx" 25 26func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 27func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 28func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 29func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 30func g_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 31func g_cat(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ dst[off+i]=s[i]; i=i+1 } return off+i } 32func g_contains(hay: *u8, n: i64, needle: *u8) -> i64 { 33 let nl: i64=g_strlen(needle); if nl==0 { return 0 } 34 var i: i64=0 35 while i+nl<=n { var j: i64=0; var hit: i64=1; while j<nl { if hay[i+j]!=needle[j] { hit=0; j=nl } else { j=j+1 } } if hit==1 { return 1 } i=i+1 } 36 return 0 37} 38func cert_row(verbose: i64, label: *u8, ok: i64) -> i64 { 39 if verbose==1 { g_puts(label); if ok==1 { g_puts(" PASS\n" as *u8) } else { g_puts(" FAIL\n" as *u8) } } 40 return ok 41} 42func g_run(elf: *u8, args: *i64, nargs: i64, out_path: *u8) -> i64 { 43 let pid: i64=sys_fork() 44 if pid==0 { 45 let o: i64=sys_openat_wr(out_path, 0x1a4); if o>=0 { sys_dup3(o,1,0) } 46 let argv: *i64=sys_mmap(8*16) as *i64; argv[0]=elf as i64 47 var i: i64=0; while i<nargs { argv[1+i]=args[i]; i=i+1 } argv[1+nargs]=0 48 let envp: *i64=sys_mmap(16) as *i64; envp[0]="PATH=/usr/bin:/bin" as *u8 as i64; envp[1]=0 49 sys_execve(elf, argv, envp); sys_exit(127) 50 } 51 let st: *i64=sys_mmap(16) as *i64; sys_wait4(pid, st, 0); return (st[0]>>8)&0xff 52} 53 54// --- pure cert predicates (each independently liar-kill-testable) --- 55// Roku hard package-size limit = 4 MB. 56func cert_size_ok(nbytes: i64) -> i64 { if nbytes>0 { if nbytes<=4194304 { return 1 } } return 0 } 57// on-device auth: a channel violates the "no external login webpage" bar if its source pairs a login token with an 58// off-device URL (a "://"). The thin-client catalog-fetch URL (https://.../catalog.json, no "login") stays clean. 59func cert_no_extlogin(src: *u8, n: i64) -> i64 { 60 if g_contains(src, n, "login" as *u8)==1 { if g_contains(src, n, "://" as *u8)==1 { return 0 } } 61 return 1 62} 63// all-models codec: if the channel declares a video stream, it must carry an H.264/MP4 (AVC) rendition (HEVC/VP9/AV1 64// are 4K-only). No declared stream -> trivially all-models-OK. 65func cert_video_allmodels(src: *u8, n: i64) -> i64 { 66 var hasvid: i64=0 67 if g_contains(src, n, ".m3u8" as *u8)==1 { hasvid=1 } 68 if g_contains(src, n, ".mpd" as *u8)==1 { hasvid=1 } 69 if g_contains(src, n, "STREAMURL" as *u8)==1 { hasvid=1 } 70 if hasvid==0 { return 1 } 71 if g_contains(src, n, "h264" as *u8)==1 { return 1 } 72 if g_contains(src, n, ".mp4" as *u8)==1 { return 1 } 73 if g_contains(src, n, "avc" as *u8)==1 { return 1 } 74 return 0 75} 76 77// run the 10 static cert bars against an emitted channel zip; print rows if verbose; return pass count 0..10. 78func cert_eval(zip: *u8, verbose: i64) -> i64 { 79 let szp: *i64=sys_mmap(16) as *i64 80 let zbuf: *u8=sys_read_file(zip, szp) 81 var zn: i64=0 82 if (zbuf as i64)!=0 { zn=szp[0] } 83 84 var b1: i64=0 85 if zn>=4 { if zbuf[0]==(0x50 as u8) { if zbuf[1]==(0x4b as u8) { if zbuf[2]==(0x03 as u8) { if zbuf[3]==(0x04 as u8) { b1=1 } } } } } 86 let b2: i64=cert_size_ok(zn) 87 88 let mbuf: *u8=sys_mmap(8192) 89 let mn: i64=opc_read_part(zip, "manifest" as *u8, mbuf, 8192) 90 var b3: i64=0; if mn>0 { b3=1 } 91 var b4: i64=0; if mn>0 { b4=g_contains(mbuf, mn, "title=" as *u8) } 92 var b5: i64=0 93 if mn>0 { if g_contains(mbuf,mn,"major_version=" as *u8)==1 { if g_contains(mbuf,mn,"minor_version=" as *u8)==1 { if g_contains(mbuf,mn,"build_version=" as *u8)==1 { b5=1 } } } } 94 var b6: i64=0; if mn>0 { b6=g_contains(mbuf, mn, "mm_icon_focus_hd=" as *u8) } 95 96 let ibuf: *u8=sys_mmap(262144) 97 let inb: i64=opc_read_part(zip, "images/icon.png" as *u8, ibuf, 262144) 98 var b7: i64=0 99 if inb>=8 { if ibuf[0]==(0x89 as u8) { if ibuf[1]==(0x50 as u8) { if ibuf[2]==(0x4e as u8) { if ibuf[3]==(0x47 as u8) { b7=1 } } } } } 100 101 let b8: i64=cert_no_extlogin(zbuf, zn) 102 103 let bbuf: *u8=sys_mmap(8192) 104 let bn: i64=opc_read_part(zip, "source/main.brs" as *u8, bbuf, 8192) 105 var b9: i64=0 106 if bn>0 { if g_contains(bbuf,bn,"Main(args" as *u8)==1 { if g_contains(bbuf,bn,"args.contentId" as *u8)==1 { if g_contains(bbuf,bn,"args.mediaType" as *u8)==1 { b9=1 } } } } 107 108 let b10: i64=cert_video_allmodels(zbuf, zn) 109 110 var pass: i64=0 111 pass=pass+cert_row(verbose, " C1 valid ZIP package (PK\\x03\\x04)" as *u8, b1) 112 pass=pass+cert_row(verbose, " C2 package <= 4 MB (Roku hard limit)" as *u8, b2) 113 pass=pass+cert_row(verbose, " C3 manifest present at zip root" as *u8, b3) 114 pass=pass+cert_row(verbose, " C4 manifest -> title=" as *u8, b4) 115 pass=pass+cert_row(verbose, " C5 manifest -> version triplet" as *u8, b5) 116 pass=pass+cert_row(verbose, " C6 manifest -> mm_icon_focus_hd" as *u8, b6) 117 pass=pass+cert_row(verbose, " C7 channel icon PNG present + valid" as *u8, b7) 118 pass=pass+cert_row(verbose, " C8 on-device auth (no external login page)" as *u8, b8) 119 pass=pass+cert_row(verbose, " C9 deep-link entry (Main(args)+contentId+mediaType)" as *u8, b9) 120 pass=pass+cert_row(verbose, " C10 video all-models H.264 baseline (no video -> vacuous)" as *u8, b10) 121 return pass 122} 123 124// build a deliberately NON-COMPLIANT channel (no title/versions/icon, an external login page, no deep-link entry) 125// so the composite liar-kill can prove cert_eval rejects it. returns zip bytes (or <0). 126func build_bad_channel(path: *u8) -> i64 { 127 let manifest: *u8=sys_mmap(1024); var mo: i64=0 128 mo=g_cat(manifest, mo, "ui_resolutions=hd\n" as *u8) 129 let mbrs: *u8=sys_mmap(1024); var bo: i64=0 130 bo=g_cat(mbrs, bo, "sub Main()\n" as *u8) 131 bo=g_cat(mbrs, bo, " x = CreateObject(\"roUrlTransfer\")\n" as *u8) 132 bo=g_cat(mbrs, bo, " x.setUrl(\"https://acct.example.com/login\")\n" as *u8) 133 bo=g_cat(mbrs, bo, "end sub\n" as *u8) 134 let names: *i64=sys_mmap(64) as *i64 135 let datap: *i64=sys_mmap(64) as *i64 136 let lens: *i64=sys_mmap(64) as *i64 137 names[0]="manifest" as *u8 as i64; datap[0]=manifest as i64; lens[0]=mo 138 names[1]="source/main.brs" as *u8 as i64; datap[1]=mbrs as i64; lens[1]=bo 139 return opc_write(path, names, datap, lens, 2) 140} 141 142func main() -> i64 { 143 g_puts("=== ROKU CERT GATE: static Channel-Store cert-readiness (sovereign, no python, no device) ===\n" as *u8) 144 let GRID_EMIT: *u8="/tmp/nx_roku_grid_emit.sov.elf" as *u8 145 let GOODZIP: *u8="/tmp/roku_cert_good.zip" as *u8 146 let BADZIP: *u8="/tmp/roku_cert_bad.zip" as *u8 147 let scr: *u8="/tmp/roku_cert_scratch.txt" as *u8 148 let a: *i64=sys_mmap(8*8) as *i64 149 150 // emit the embedded grid channel (the Channel-Store submit build) 151 a[0]=GOODZIP as i64 152 g_run(GRID_EMIT, a, 1, scr) 153 154 g_puts("-- certifying channel: embedded grid (the Channel-Store submit build) --\n" as *u8) 155 let good: i64=cert_eval(GOODZIP, 1) 156 157 // composite liar-kill: a deliberately non-compliant channel must fail cert 158 build_bad_channel(BADZIP) 159 let bad: i64=cert_eval(BADZIP, 0) 160 161 g_puts("-- liar-kills (the gate cannot false-green) --\n" as *u8) 162 var pass: i64=good; let rows: i64=14 163 var lk1: i64=0; if cert_size_ok(4194305)==0 { lk1=1 } 164 pass=pass+cert_row(1, " L1 oversize package (>4MB) rejected" as *u8, lk1) 165 let badsrc: *u8="x.setUrl(\"https://acct.example.com/login\")" as *u8 166 var lk2: i64=0; if cert_no_extlogin(badsrc, g_strlen(badsrc))==0 { lk2=1 } 167 pass=pass+cert_row(1, " L2 external login page detected" as *u8, lk2) 168 let xbuf: *u8=sys_mmap(64) 169 let xn: i64=opc_read_part(GOODZIP, "no_such_root_file" as *u8, xbuf, 64) 170 var lk3: i64=0; if xn<0 { lk3=1 } 171 pass=pass+cert_row(1, " L3 unknown part returns <0" as *u8, lk3) 172 var lk4: i64=0; if bad<10 { lk4=1 } 173 pass=pass+cert_row(1, " L4 tampered channel fails cert (<10 bars)" as *u8, lk4) 174 175 g_puts("-- NOT covered by this STATIC gate (DEVICE-verified before submission):\n" as *u8) 176 g_puts(" launch<15s, video-start<8s, back-button behavior, on-TV deep-link routing\n" as *u8) 177 g_puts("-- DEFERRED RISK: royalty-free-only (VP9/AV1) vs Roku all-models H.264 baseline\n" as *u8) 178 g_puts(" -> resolve via Track L (nx_counsel) before any video item ships\n" as *u8) 179 180 g_puts("----\nROKU-CERT rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass) 181 g_puts(" good=" as *u8); g_num(good); g_puts("/10 bad=" as *u8); g_num(bad); g_puts("/10\n" as *u8) 182 let lg: i64=sys_openat_append("knowledge/status/roku_cert_gate.log" as *u8, 0x1a4) 183 if lg>=0 { g_w(lg, "ROKU-CERT rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass); if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } sys_close(lg) } 184 if pass==rows { g_puts("ROKU-CERT GREEN (channel meets all statically-provable Channel-Store cert bars)\n" as *u8); sys_exit(0); return 0 } 185 g_puts("ROKU-CERT RED\n" as *u8); sys_exit(1); return 1 186}