196 lines
6.5 KiB
TOML
196 lines
6.5 KiB
TOML
schema = 2
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
|
|
[pidfs_host_support]
|
|
id = "pidfs-process-identity-v1"
|
|
platform = "linux-x86_64"
|
|
minimum_kernel = "6.9"
|
|
probe = "pidfs-host-support-probe-v1"
|
|
qualification_ids = ["upstream-linux-6.9.0-x86_64"]
|
|
runtime_failure_policy = "fail-before-generation"
|
|
verifier_unavailable_policy = "skip"
|
|
bounded_claim = "current-boot-smoke-only"
|
|
diagnostic_platform = "LZ-HOST-PIDFS-PLATFORM: PidfsProcessIdentityV1 requires Linux x86-64."
|
|
diagnostic_kernel = "LZ-HOST-PIDFS-KERNEL: PidfsProcessIdentityV1 requires Linux x86-64 kernel 6.9 or newer; Linux 6.8 is unsupported even with a partial pidfs backport."
|
|
diagnostic_qualification = "LZ-HOST-PIDFS-QUALIFICATION: the running kernel build has no exact qualified source/build record."
|
|
diagnostic_smoke = "LZ-HOST-PIDFS-SMOKE: the bounded per-boot pidfs support smoke failed; no runtime resource or durable generation may be created."
|
|
|
|
[[host_probe]]
|
|
id = "pidfs-host-support-probe-v1"
|
|
owner = "IP-03"
|
|
cache_key = "boot_id"
|
|
result_claim = "bounded-current-boot-observations"
|
|
attempts_per_step = 1
|
|
step_timeout_ms = 5000
|
|
total_timeout_ms = 60000
|
|
cleanup_timeout_ms = 5000
|
|
steps = [
|
|
"linux-x86_64-kernel-floor",
|
|
"pidfd-operations",
|
|
"pidfs-magic",
|
|
"concurrent-same-process-identity",
|
|
"last-close-live-reopen-identity",
|
|
"simultaneous-process-distinct-inode",
|
|
"stale-handle-cannot-affect-live-peer",
|
|
"exit-reap-drop-all-later-process-non-reuse",
|
|
]
|
|
|
|
[[kernel_qualification]]
|
|
id = "upstream-linux-6.9.0-x86_64"
|
|
kind = "upstream"
|
|
architecture = "x86_64"
|
|
release = "6.9.0"
|
|
source_ref = "v6.9"
|
|
source_commit = "a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6"
|
|
source_archive_sha256 = "24fa01fb989c7a3e28453f117799168713766e119c5381dac30115f18f268149"
|
|
source_signer_fingerprint = "647F28654894E3BD457199BE38DBBDC86092693E"
|
|
build_config_sha256 = "7db4d48deb650052df60273c7f2c2d228c981db4d6f76b8eb929a9e120d7283a"
|
|
build_image_sha256 = "e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc"
|
|
probe_binary_sha256 = "040a84f2b06ae73671c262016c649fe21e3fb21fad89cea3d6d76f8d7436648f"
|
|
reuse_result_sha256 = "b8491adc9c0fd4509ec94a99d03835842f7f92ca6d5baad8f6589a7f3c49517f"
|
|
acquisition_result_sha256 = "867492f65ffd473733544626c032957143f40d040e1a4e8e1e82bf9e4bca6cc3"
|
|
pidfs_inode_semantics = "boot-monotonic-u64"
|
|
status = "qualified"
|
|
|
|
[[command]]
|
|
id = "python"
|
|
program = "python3"
|
|
args = ["--version"]
|
|
version_pattern = '^Python 3\.(1[1-9]|[2-9][0-9])\.'
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Python 3.11 or newer is required for repository verification."
|
|
|
|
[[command]]
|
|
id = "rustc"
|
|
program = "rustc"
|
|
args = ["--version"]
|
|
version_pattern = '^rustc 1\.90\.0 '
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
|
|
|
[[command]]
|
|
id = "cargo"
|
|
program = "cargo"
|
|
args = ["--version"]
|
|
version_pattern = '^cargo 1\.90\.0 '
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
|
|
|
[[command]]
|
|
id = "cargo-deny"
|
|
program = "cargo-deny"
|
|
args = ["--version"]
|
|
version_pattern = '^cargo-deny 0\.20\.2$'
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install cargo-deny 0.20.2 with its locked dependency graph."
|
|
|
|
[[command]]
|
|
id = "git"
|
|
program = "git"
|
|
args = ["--version"]
|
|
version_pattern = '^git version 2\.'
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Git 2.x is required for generated-file drift checks."
|
|
|
|
[[command]]
|
|
id = "tlc"
|
|
program = "tlc"
|
|
args = ["-h"]
|
|
version_pattern = 'Version 2\.19 '
|
|
accepted_exit_codes = [0, 1]
|
|
policy = "fail"
|
|
levels = ["V1", "V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the TLC 2.19 launcher on PATH."
|
|
|
|
[[command]]
|
|
id = "runsc"
|
|
program = "runsc"
|
|
args = ["--version"]
|
|
version_pattern = '^runsc version release-20260622\.0\nspec: 1\.2\.1$'
|
|
policy = "skip"
|
|
levels = ["V3", "V4", "V5"]
|
|
diagnostic = "The selected composition is qualified on runsc release-20260622.0."
|
|
|
|
[[command]]
|
|
id = "fuse-overlayfs"
|
|
program = "fuse-overlayfs"
|
|
args = ["--version"]
|
|
version_pattern = '^fusermount3 version: 3\.18\.2\nfuse-overlayfs: version 1\.16\nFUSE library version 3\.18\.2\nusing FUSE kernel interface version 7\.45$'
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the qualified fuse-overlayfs 1.16 and FUSE 3.18.2 stack."
|
|
|
|
[[command]]
|
|
id = "slirp4netns"
|
|
program = "slirp4netns"
|
|
args = ["--version"]
|
|
version_pattern = '^slirp4netns version 1\.3\.1\ncommit: .+\nlibslirp: 4\.9\.1\nSLIRP_CONFIG_VERSION_MAX: 6\nlibseccomp: 2\.6\.0$'
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."
|
|
|
|
[[command]]
|
|
id = "strace"
|
|
program = "strace"
|
|
args = ["--version"]
|
|
version_pattern = '^strace -- version [6-9]\.|^strace -- version [1-9][0-9]\.'
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Install strace 6.x or newer to run the registered final-binary exercised-path syscall cases."
|
|
|
|
[[feature]]
|
|
id = "linux-x86_64"
|
|
probe = "linux-x86_64"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Physical and composition suites currently support Linux x86_64."
|
|
|
|
[[feature]]
|
|
id = "kernel"
|
|
probe = "kernel-at-least"
|
|
minimum = "6.9"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Linux x86-64 kernel 6.9 or newer is required; Linux 6.8 is unsupported for pidfs process identity."
|
|
|
|
[[feature]]
|
|
id = "pidfs-host-support"
|
|
probe = "registered-host-support"
|
|
contract = "pidfs-process-identity-v1"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "PidfsHostSupportProbe execution is owned by IP-03; this scaffold cannot claim host support from a version string or manifest record."
|
|
|
|
[[feature]]
|
|
id = "user-namespaces"
|
|
probe = "user-namespace"
|
|
program = "unshare"
|
|
sysctl_path = "/proc/sys/user/max_user_namespaces"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Enable functional unprivileged user namespace creation for physical runtime tests."
|
|
|
|
[[feature]]
|
|
id = "subordinate-ids"
|
|
probe = "subordinate-ids"
|
|
minimum_count = 65536
|
|
uidmap_program = "newuidmap"
|
|
gidmap_program = "newgidmap"
|
|
unshare_program = "unshare"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Configure usable 65,536-ID subordinate UID/GID ranges and mapping helpers for the current user."
|
|
|
|
[[feature]]
|
|
id = "fuse-device"
|
|
probe = "open-character-device"
|
|
path = "/dev/fuse"
|
|
access = "read-write"
|
|
policy = "skip"
|
|
levels = ["V2", "V3", "V4", "V5"]
|
|
diagnostic = "Expose an openable read-write /dev/fuse device to run physical filesystem suites."
|