base64-ng 2.0.0

no_std-first Base64 encoding and decoding with strict APIs and a security-heavy release process
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

#!/usr/bin/env python3
"""Verify that retained external campaigns still cover the current candidate."""

from __future__ import annotations

import argparse
import re
import subprocess
from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]
FULL_COMMIT = re.compile(r"[0-9a-f]{40}")
ALLOWED_TOOLING_CHANGES = {
    "docs/RELEASE.md",
    "docs/RELEASE_EVIDENCE.md",
    "scripts/aggregate-fuzz-shards.sh",
    "scripts/checks.sh",
    "scripts/finalize-release-evidence.sh",
    "scripts/fuzz_shard_evidence.py",
    "scripts/stable_release_gate.sh",
    "scripts/test-campaign-source-equivalence.py",
    "scripts/test-fuzz-shard-evidence.py",
    "scripts/test-neon-admission-bundle.py",
    "scripts/validate-campaign-source-equivalence.py",
    "scripts/validate-neon-admission-bundle.py",
    "scripts/validate-release-metadata.sh",
    "security/pentest/v2.0.0.md",
}


def fail(message: str) -> None:
    raise SystemExit(f"campaign source equivalence: {message}")


def git(*arguments: str, check: bool = True) -> str:
    result = subprocess.run(
        ["git", *arguments],
        cwd=ROOT,
        check=False,
        capture_output=True,
        text=True,
    )
    if check and result.returncode != 0:
        detail = result.stderr.strip() or result.stdout.strip()
        fail(f"git {' '.join(arguments)} failed: {detail}")
    return result.stdout.strip()


def resolve(revision: str, label: str) -> str:
    commit = git("rev-parse", "--verify", f"{revision}^{{commit}}")
    if FULL_COMMIT.fullmatch(commit) is None:
        fail(f"{label} is not an exact commit")
    return commit


def validate(campaign_revision: str, candidate_revision: str) -> tuple[str, str]:
    campaign = resolve(campaign_revision, "campaign source")
    candidate = resolve(candidate_revision, "candidate source")
    if campaign == candidate:
        fail("campaign and candidate commits must differ")
    if subprocess.run(
        ["git", "merge-base", "--is-ancestor", campaign, candidate],
        cwd=ROOT,
        check=False,
    ).returncode != 0:
        fail("campaign source is not an ancestor of the candidate")
    if git("rev-list", "--merges", f"{campaign}..{candidate}"):
        fail("campaign-to-candidate range contains a merge commit")
    if candidate == resolve("HEAD", "HEAD") and git(
        "status", "--porcelain", "--untracked-files=all"
    ):
        fail("candidate worktree is not clean")

    changed = set(
        git(
            "diff",
            "--name-only",
            "--diff-filter=ACDMRTUXB",
            campaign,
            candidate,
        ).splitlines()
    )
    if not changed:
        fail("campaign-to-candidate range contains no changes")
    if changed != ALLOWED_TOOLING_CHANGES:
        missing = sorted(ALLOWED_TOOLING_CHANGES - changed)
        unexpected = sorted(changed - ALLOWED_TOOLING_CHANGES)
        fail(f"correction inventory mismatch: missing={missing} unexpected={unexpected}")

    print(
        "campaign source equivalence: runtime, crates, tests, fuzz inputs, "
        "dependencies, and toolchain are unchanged across the linear "
        "correction range"
    )
    return campaign, candidate


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--campaign", required=True)
    parser.add_argument("--candidate", default="HEAD")
    arguments = parser.parse_args()
    validate(arguments.campaign, arguments.candidate)


if __name__ == "__main__":
    main()