128 lines
3.6 KiB
TOML
128 lines
3.6 KiB
TOML
schema = 1
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
|
|
[[command]]
|
|
id = "python"
|
|
program = "python3"
|
|
args = ["--version"]
|
|
version_pattern = '^Python 3\.(1[1-9]|[2-9][0-9])\.'
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Python 3.11 or newer is required for repository verification."
|
|
|
|
[[command]]
|
|
id = "rustc"
|
|
program = "rustc"
|
|
args = ["--version"]
|
|
version_pattern = '^rustc 1\.90\.0 '
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
|
|
|
[[command]]
|
|
id = "cargo"
|
|
program = "cargo"
|
|
args = ["--version"]
|
|
version_pattern = '^cargo 1\.90\.0 '
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
|
|
|
[[command]]
|
|
id = "cargo-deny"
|
|
program = "cargo-deny"
|
|
args = ["--version"]
|
|
version_pattern = '^cargo-deny 0\.20\.2$'
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install cargo-deny 0.20.2 with its locked dependency graph."
|
|
|
|
[[command]]
|
|
id = "git"
|
|
program = "git"
|
|
args = ["--version"]
|
|
version_pattern = '^git version 2\.'
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Git 2.x is required for generated-file drift checks."
|
|
|
|
[[command]]
|
|
id = "tlc"
|
|
program = "tlc"
|
|
args = ["-h"]
|
|
version_pattern = 'Version 2\.19 '
|
|
accepted_exit_codes = [0, 1]
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the TLC 2.19 launcher on PATH."
|
|
|
|
[[command]]
|
|
id = "runsc"
|
|
program = "runsc"
|
|
args = ["--version"]
|
|
version_pattern = '^runsc version release-20260622\.0\nspec: 1\.2\.1$'
|
|
policy = "skip"
|
|
levels = ["V3", "V4", "V5"]
|
|
diagnostic = "The selected composition is qualified on runsc release-20260622.0."
|
|
|
|
[[command]]
|
|
id = "fuse-overlayfs"
|
|
program = "fuse-overlayfs"
|
|
args = ["--version"]
|
|
version_pattern = '^fusermount3 version: 3\.18\.2\nfuse-overlayfs: version 1\.16\nFUSE library version 3\.18\.2\nusing FUSE kernel interface version 7\.45$'
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the qualified fuse-overlayfs 1.16 and FUSE 3.18.2 stack."
|
|
|
|
[[command]]
|
|
id = "slirp4netns"
|
|
program = "slirp4netns"
|
|
args = ["--version"]
|
|
version_pattern = '^slirp4netns version 1\.3\.1\ncommit: .+\nlibslirp: 4\.9\.1\nSLIRP_CONFIG_VERSION_MAX: 6\nlibseccomp: 2\.6\.0$'
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."
|
|
|
|
[[feature]]
|
|
id = "linux-x86_64"
|
|
probe = "linux-x86_64"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Physical and composition suites currently support Linux x86_64."
|
|
|
|
[[feature]]
|
|
id = "kernel"
|
|
probe = "kernel-at-least"
|
|
minimum = "6.8"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Linux 6.8 or newer supplies the qualified namespace and pidfd baseline."
|
|
|
|
[[feature]]
|
|
id = "user-namespaces"
|
|
probe = "user-namespace"
|
|
program = "unshare"
|
|
sysctl_path = "/proc/sys/user/max_user_namespaces"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Enable functional unprivileged user namespace creation for physical runtime tests."
|
|
|
|
[[feature]]
|
|
id = "subordinate-ids"
|
|
probe = "subordinate-ids"
|
|
minimum_count = 65536
|
|
uidmap_program = "newuidmap"
|
|
gidmap_program = "newgidmap"
|
|
unshare_program = "unshare"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Configure usable 65,536-ID subordinate UID/GID ranges and mapping helpers for the current user."
|
|
|
|
[[feature]]
|
|
id = "fuse-device"
|
|
probe = "open-character-device"
|
|
path = "/dev/fuse"
|
|
access = "read-write"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Expose an openable read-write /dev/fuse device to run physical filesystem suites."
|