mirror of
https://github.com/saymrwulf/fips205-slhdsa-verified.git
synced 2026-09-03 19:53:49 +00:00
review round 6: pin the auditor, purge every olean, pin gen/ as a set
Round 6 confirmed the digest redesign closed NEW-1/NEW-2/NEW-5 at the mechanism
("the first time in three rounds I have not been able to gut a certificate"),
then demonstrated two more ways to reach ALL GREEN with the committed digest
BYTE-IDENTICAL over a repository proving False. Both are fixed.
NEW-7 — the digest bound the audit's DATA, never its LOGIC. Flipping the two
fail-closed guards in Proofs/Audit.lean to `unless true` disabled every in-Lean
check; the block's inputs genuinely had not changed, so the digest still
matched. Total attacker diff: 2 files, 6 insertions. Worse, TRUSTED-BASE item 11
listed the trusted-unbound set and did NOT mention Audit.lean, so a reviewer
using it as a map of what to read by hand would have skipped the file that
computes the number it is judged by.
FIX: Proofs/Audit.lean is now sha256-pinned in harness_integrity_sha256,
symmetric with lean-guard, and item 11 says so — including the honest residue:
an author who edits the logic AND rotates its pin is caught only by reading the
diff at the pin.
NEW-8 — Phase 0's purge covered gen/ and Proofs/ while the stray check greped
only *.lean, so an ORPHAN verification/Evil.olean whose source had been DELETED
fell between them, satisfied an import, and was invisible to git status
(*.olean is gitignored).
FIX: purge every .olean under verification/, and forbid stray .lean AND .olean.
NEW-9 (partial) — gen/ was pinned by four NAMES, not as a SET, so a new file
there was neither hashed nor forbidden while LEAN_PATH contains $PWD/gen.
FIX: Phase 0 asserts the gen/*.lean file set equals the pin map exactly. This
found a real gap on its first run: Aeneas emits *_Template.lean scaffolding into
gen/ on every extraction — untracked byproducts (a fresh clone has only the four
pinned files) that nothing imports but that sat on LEAN_PATH unpinned. They are
now purged as byproducts before the set assertion.
Also, from the reviewer's §3 suggestion: the canonical block is now COMMITTED as
verification/AUDIT-MANIFEST.txt, so a digest mismatch prints a real diff instead
of writing an observed file with nothing to compare against; check.sh also fails
if the committed copy drifts from what Lean emits.
check-selftest.sh: 16 attacks, all rejected, plus the coverage check. Attacks 16
and 17 are the reviewer's two demonstrations. Attacks that mutate the audit's
DATA now re-pin Audit.lean first, so they still test the digest/enumeration
rather than being stopped by the byte pin; attack 17 deliberately does not
re-pin, because the pin is what it tests.
Housekeeping: PROVENANCE.json trailing newline restored (NEW-12).
Disclosed rather than buried: two more of my own assertion bugs this round —
attack 16 asserted the hygiene message when the correct rejection is the purge
plus a failed import, and the earlier gen/ set check surfaced the template files
only because it was written strictly. Both are the wrong-diagnostic class.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
parent
dce0473013
commit
e6ffd16277
6 changed files with 273 additions and 26 deletions
|
|
@ -69,7 +69,19 @@ proceeds and is part of every claim.
|
|||
(`PROVENANCE.json → harness_integrity_sha256`); it is kept rather than
|
||||
removed because it is the memory cap and machine-wide lock that protect the
|
||||
build machine (a Lean elaboration once reached 12.2 GB and took the host
|
||||
down). Still trusted, and NOT bound by anything the button can check:
|
||||
down).
|
||||
**`verification/Proofs/Audit.lean` is pinned the same way, and for a sharper
|
||||
reason** (round-6 NEW-7): the digest it emits binds the audit's *data* — the
|
||||
policy constants, the statements, the specification bodies — but nothing can
|
||||
make a program hash the correctness of its own logic. Flipping this file's
|
||||
two fail-closed guards to `unless true` disabled every in-Lean check while
|
||||
the digest stayed BYTE-IDENTICAL, and a repository proving `False` passed
|
||||
ALL GREEN. The byte pin converts that from a silent green into a build
|
||||
failure; a legitimate change to the audit is now a reviewable pin rotation.
|
||||
Note the residue honestly: an author who edits the logic *and* rotates its
|
||||
pin in the same commit is not stopped by anything mechanical — that case is
|
||||
caught only by reading the diff at the pin.
|
||||
Still trusted, and NOT bound by anything the button can check:
|
||||
`check.sh` itself, `~/aeneas-toolchain/env.sh`, the `$AENEAS_HOME` tree
|
||||
(i.e. *which* Aeneas/Lean library the proofs are checked against), `python3`,
|
||||
and the Lean toolchain. An audit executed by a harness cannot defend against
|
||||
|
|
|
|||
53
verification/AUDIT-MANIFEST.txt
Normal file
53
verification/AUDIT-MANIFEST.txt
Normal file
File diff suppressed because one or more lines are too long
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"_comment": "Single machine-readable pin set to reproduce the extracted Lean model in gen/SlhVerify from source. External review rounds 2-5 (2026-07-24 .. 2026-07-27). Running verification/extract.sh against the pinned source tree with the pinned Charon/Aeneas toolchain reproduces the two aeneas-generated files byte-identically (generated_artifacts_sha256 below). The *External*.lean files are hand-maintained (not regenerated) and are NOT part of that reproducibility claim — but they ARE byte-pinned for integrity in model_integrity_sha256, since they carry the five oracle axioms and the discharged Step definitions. NOTE: SlhVerify.llbc is an intermediate artifact and is .gitignored, so its hash here can only be checked by a party who re-runs extract.sh.",
|
||||
"_comment": "Single machine-readable pin set to reproduce the extracted Lean model in gen/SlhVerify from source. External review rounds 2-5 (2026-07-24 .. 2026-07-27). Running verification/extract.sh against the pinned source tree with the pinned Charon/Aeneas toolchain reproduces the two aeneas-generated files byte-identically (generated_artifacts_sha256 below). The *External*.lean files are hand-maintained (not regenerated) and are NOT part of that reproducibility claim \u2014 but they ARE byte-pinned for integrity in model_integrity_sha256, since they carry the five oracle axioms and the discharged Step definitions. NOTE: SlhVerify.llbc is an intermediate artifact and is .gitignored, so its hash here can only be checked by a party who re-runs extract.sh.",
|
||||
"parameter_set": "SLH-DSA-SHA2-128s",
|
||||
"source": {
|
||||
"repo": "github.com/saymrwulf/fips205-source",
|
||||
|
|
@ -45,8 +45,9 @@
|
|||
"gen/SlhVerify/Funs.lean": "7b7de55fd0206142f2678a079a6ed4462292356bc7de08ecd55cac0c76a1da9f"
|
||||
},
|
||||
"harness_integrity_sha256": {
|
||||
"_comment": "The compiler harness is part of the trusted computing base: check.sh shells out to lean-guard for every compile, and round-5 review demonstrated that stubbing it alone yields ALL GREEN in 3.6s over destroyed proofs. lean-guard is KEPT (it is the memory cap and machine-wide lock that protect this machine after the 12.2GB OOM incident) and sha256-pinned by Phase 0. NOT covered, and disclosed as trusted in TRUSTED-BASE.md item 11: check.sh itself, ~/aeneas-toolchain/env.sh, $AENEAS_HOME, python3, and the Lean toolchain.",
|
||||
"lean-guard": "690d861cfd81b327604ffd5ef85599ee01b2bcd943907f5b71b8b6f99bad418f"
|
||||
"_comment": "The harness is part of the trusted computing base. check.sh shells out to lean-guard for every compile (round-5 NEW-3: stubbing it alone yielded ALL GREEN in 3.6s over destroyed proofs), and Proofs/Audit.lean is the program that COMPUTES the digest it is judged by (round-6 NEW-7: flipping two fail-closed guards to `unless true` let a repo proving False pass with the digest BYTE-IDENTICAL \u2014 the digest binds the audit's DATA, never its LOGIC). Both are sha256-pinned by Phase 0, so tampering with either is a build failure rather than a silent green, and any legitimate change is a reviewable pin rotation. STILL trusted and unbound, disclosed in TRUSTED-BASE.md item 11: check.sh itself, ~/aeneas-toolchain/env.sh, $AENEAS_HOME, python3, and the Lean toolchain.",
|
||||
"lean-guard": "690d861cfd81b327604ffd5ef85599ee01b2bcd943907f5b71b8b6f99bad418f",
|
||||
"Proofs/Audit.lean": "6108b97d75a8a8e8e0b9bef642ba887ea1ae8b17ba5b7c11d66400bfd2847d9e"
|
||||
},
|
||||
"audit_gate": "verification/Proofs/Audit.lean \u2014 in-Lean audit (round 5). Per certificate: exact cone equality (collectAxioms) + elaborated-statement check. Enumeration: EVERY declaration kind (def/theorem/opaque/axiom \u2014 round 4 matched theorems only, so a `def : False` passed) in the eight certificate modules AND in Audit.lean itself (the auditor is not exempt). Binding digest: check.sh binds to the SHA-256 of a canonical AUDIT-MANIFEST block covering the POLICY constants (allowedBoundary + certModules \u2014 round-5 NEW-1: widening allowedBoundary previously re-opened the False-proof with the fingerprint byte-identical), every certificate's fully-elaborated statement, and every reachable specification definition's fully-elaborated BODY (round-5 NEW-2: redefining a reference fold to *be* the extracted loop previously left cone and fingerprint intact while the certificate degenerated to `loop = loop`). The 32-bit Expr.hash is retained only as a per-certificate diagnostic, not as the binding. Fail-closed; adversarially exercised by check-selftest.sh. check.sh Phase 0 additionally purges stale .olean files, forbids stray .lean outside gen/ and Proofs/, and pins model + harness bytes."
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -277,3 +277,75 @@ a stubbed harness, and stray modules.
|
|||
Note: the `_f: command not found` line in the selftest transcript above is a
|
||||
cosmetic shell-quoting bug in the script's own success message (backticks inside
|
||||
a double-quoted echo), fixed in this same commit. It did not affect any gate.
|
||||
|
||||
## Round-6 hardening — author-agent run, 20260728T072212Z, proof repo @ (this commit)
|
||||
|
||||
Captured with `tee` from the real commands. Not independently executed.
|
||||
PIN ROTATIONS IN THIS COMMIT (stated explicitly — round-6 NEW-11):
|
||||
· harness_integrity_sha256 GAINS Proofs/Audit.lean (6108b97d…) — new pin, NEW-7.
|
||||
· no model pin rotated; gen/ bytes unchanged.
|
||||
|
||||
### check.sh
|
||||
```
|
||||
fips205-slhdsa-verified — check
|
||||
===============================
|
||||
=== Phase 0: build hygiene + model/harness integrity ===
|
||||
✓ Proofs/Audit.lean
|
||||
✓ gen/SlhVerify/Funs.lean
|
||||
✓ gen/SlhVerify/FunsExternal.lean
|
||||
✓ gen/SlhVerify/Types.lean
|
||||
✓ gen/SlhVerify/TypesExternal.lean
|
||||
✓ lean-guard
|
||||
=== Phase 1: compile the extracted model ===
|
||||
· gen/SlhVerify/TypesExternal
|
||||
· gen/SlhVerify/Types
|
||||
· gen/SlhVerify/FunsExternal
|
||||
· gen/SlhVerify/Funs
|
||||
=== Phase 2: compile the proofs ===
|
||||
· ChainSpec
|
||||
· WotsSpec
|
||||
· XmssSpec
|
||||
· HtSpec
|
||||
· ForsInnerSpec
|
||||
· ForsOuterSpec
|
||||
· InputPrepSpec
|
||||
· ApexSpec
|
||||
=== Phase 3: in-Lean audit (cones + statement fingerprints + enumeration) ===
|
||||
✓ exact-cone audit PASSED
|
||||
✓ audit-manifest digest matches (sha256 d83e297a49094c97…)
|
||||
|
||||
ALL GREEN — model compiles, proofs compile, and every certificate cone
|
||||
equals EXACTLY the three kernel axioms plus its documented SHA-2 oracles.
|
||||
Certificates proven: fips205.chain_free_loop_eq fips205.wots_loop1_eq fips205.xmss_loop_eq fips205.ht_loop_eq fips205.fors_inner_loop_eq fips205.fors_outer_loop_eq fips205.to_int_loop_eq fips205.to_byte_loop_eq fips205.wots_csum_loop_eq fips205.base2b_outer_loop_eq fips205.slh_verify_128s_accepts_iff
|
||||
```
|
||||
|
||||
### check-selftest.sh (16 attacks + digest-coverage check)
|
||||
```
|
||||
check-selftest: attacking the gates
|
||||
====================================
|
||||
✓ attack 1 rejected (dead-file gate)
|
||||
✓ attack 2 rejected (extra-axiom detection — evil_ax named)
|
||||
✓ attack 3 rejected (missing-oracle detection — exact cone, not subset)
|
||||
✓ attack 4 rejected (existence check — a vanished cert cannot pass as 0-axiom)
|
||||
✓ attack 5 rejected (enumeration — an un-manifested False theorem cannot pass)
|
||||
✓ attack 6 rejected (statement check — a gutted statement of the same cone cannot pass)
|
||||
✓ attack 7 rejected (Phase 0 model-byte integrity)
|
||||
✓ attack 8 rejected (audit-manifest digest — a silently-dropped cert cannot pass)
|
||||
✓ attack 9 rejected (digest covers allowedBoundary — the policy cannot be widened silently)
|
||||
✓ attack 10 rejected (a specification fold cannot be silently redefined to the loop)
|
||||
✓ attack 11 rejected (enumeration covers every declaration kind, not just theorems)
|
||||
✓ attack 12 rejected (the auditor audits itself — no exemption)
|
||||
✓ attack 13 rejected (Phase 0 pins lean-guard — the harness is in the TCB and bound)
|
||||
✓ attack 14 rejected (no .lean may sit outside gen/ and Proofs/)
|
||||
✓ attack 16 rejected (Phase 0 purges every .olean under verification/, so an
|
||||
orphan compiled module with no source cannot satisfy an import)
|
||||
✓ attack 17 rejected (Phase 0 pins Audit.lean — its LOGIC cannot be silently switched off)
|
||||
✓ check 15 passed (the hashed block carries all 12 reference-fold bodies,
|
||||
including the recursive _f companions and their extracted-primitive calls)
|
||||
|
||||
SELFTEST GREEN: 16 attacks rejected + digest-coverage check — dead files, extra axioms, dropped
|
||||
oracles, vanished certs, un-manifested False theorems AND defs, gutted
|
||||
statements, hand-edited models, dropped manifest rows, widened policy,
|
||||
specification folds redefined to the loop, a False-proof in the auditor,
|
||||
a stubbed harness, and stray modules.
|
||||
```
|
||||
|
|
|
|||
|
|
@ -20,6 +20,11 @@
|
|||
# previously ALL GREEN in 3.6s over destroyed proofs)
|
||||
# 14 a stray .lean beside check.sh (round-5 NEW-4:
|
||||
# LEAN_PATH includes $PWD, so it can join the environment ungated)
|
||||
# 16 an ORPHAN .olean whose source was deleted (round-6 NEW-8:
|
||||
# fell between the purge and the stray check; ALL GREEN, digest identical)
|
||||
# 17 the audit's fail-closed guards switched off (round-6 NEW-7:
|
||||
# the digest binds the audit's DATA, never its LOGIC; two characters in
|
||||
# Audit.lean defeated every gate with the digest BYTE-IDENTICAL)
|
||||
#
|
||||
# Self-cleaning: every mutated file is backed up and restored, and an EXIT trap
|
||||
# restores even on failure. Run from a clean tree.
|
||||
|
|
@ -31,10 +36,25 @@ source ~/aeneas-toolchain/env.sh
|
|||
BAKS=()
|
||||
save() { cp -p "$1" "$1.sfbak"; BAKS+=("$1"); }
|
||||
restore() { for f in "${BAKS[@]:-}"; do [ -f "$f.sfbak" ] && mv -f "$f.sfbak" "$f"; done; BAKS=(); }
|
||||
# Proofs/Audit.lean is sha256-pinned by Phase 0 since round 6 (NEW-7). An attack
|
||||
# that mutates the audit's DATA must therefore ALSO rotate that pin, otherwise it
|
||||
# is stopped by the byte pin and never reaches the mechanism it means to test —
|
||||
# the "rejected for an unrelated reason" defect class. `repin_audit` simulates an
|
||||
# author who edits and dutifully re-pins; the digest/enumeration must still bite.
|
||||
# Attack 17 deliberately does NOT re-pin: it is the test of the pin itself.
|
||||
repin_audit() {
|
||||
python3 - <<'PY'
|
||||
import json, hashlib
|
||||
p = "PROVENANCE.json"; d = json.load(open(p))
|
||||
d["harness_integrity_sha256"]["Proofs/Audit.lean"] = hashlib.sha256(
|
||||
open("Proofs/Audit.lean","rb").read()).hexdigest()
|
||||
json.dump(d, open(p,"w"), indent=2); open(p,"a").write("\n")
|
||||
PY
|
||||
}
|
||||
cleanup() {
|
||||
restore
|
||||
rm -f Proofs/Stray.lean Proofs/EvilSpec.lean Evil.lean \
|
||||
Proofs/*.olean gen/SlhVerify/*.olean .audit-manifest.observed 2>/dev/null
|
||||
rm -f Proofs/Stray.lean Proofs/EvilSpec.lean Evil.lean Evil.olean \
|
||||
Proofs/*.olean gen/SlhVerify/*.olean *.olean .audit-manifest.observed 2>/dev/null
|
||||
return 0
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
|
@ -52,7 +72,7 @@ rm -f Proofs/Stray.lean
|
|||
echo "✓ attack 1 rejected (dead-file gate)"
|
||||
|
||||
# ── 2: smuggled disallowed axiom in a real cone ─────────────────────────────
|
||||
save check.sh; save Proofs/Audit.lean
|
||||
save check.sh; save Proofs/Audit.lean; save PROVENANCE.json
|
||||
# NB: no imports — Phase 0 now purges every .olean, so a module injected at the
|
||||
# head of the build order cannot import one that has not been compiled yet.
|
||||
cat > Proofs/EvilSpec.lean <<'EOF'
|
||||
|
|
@ -69,13 +89,14 @@ a = a.replace('import Proofs.ApexSpec', 'import Proofs.ApexSpec\nimport Proofs.E
|
|||
a = a.replace(' [ (`fips205.chain_free_loop_eq', ' [ (`evil_thm, kernel3, 0),\n (`fips205.chain_free_loop_eq', 1)
|
||||
open("Proofs/Audit.lean","w").write(a)
|
||||
PY
|
||||
repin_audit
|
||||
./check.sh > /tmp/sf2.out 2>&1 && fail "ATTACK 2 SUCCEEDED (smuggled axiom)" /tmp/sf2.out
|
||||
grep -q "evil_ax" /tmp/sf2.out || fail "ATTACK 2: rejected but evil_ax not named" /tmp/sf2.out
|
||||
restore; rm -f Proofs/EvilSpec.lean
|
||||
echo "✓ attack 2 rejected (extra-axiom detection — evil_ax named)"
|
||||
|
||||
# ── 3: dropped oracle (a subset check would pass; exact must not) ────────────
|
||||
save Proofs/Audit.lean
|
||||
save Proofs/Audit.lean; save PROVENANCE.json
|
||||
python3 - <<'PY'
|
||||
import re
|
||||
a = open("Proofs/Audit.lean").read()
|
||||
|
|
@ -83,18 +104,20 @@ new, n = re.subn(r'(`fips205\.to_int_loop_eq,\s*)kernel3,', r'\1kernel3 ++ [orac
|
|||
assert n == 1, f"expected 1 to_int row, patched {n}"
|
||||
open("Proofs/Audit.lean","w").write(new)
|
||||
PY
|
||||
repin_audit
|
||||
./check.sh > /tmp/sf3.out 2>&1 && fail "ATTACK 3 SUCCEEDED (dropped oracle — subset hole)" /tmp/sf3.out
|
||||
grep -q "missing=\[verify_mono.oracle.f\]" /tmp/sf3.out || fail "ATTACK 3: rejected but missing oracle not named" /tmp/sf3.out
|
||||
restore
|
||||
echo "✓ attack 3 rejected (missing-oracle detection — exact cone, not subset)"
|
||||
|
||||
# ── 4: vanished certificate ─────────────────────────────────────────────────
|
||||
save Proofs/Audit.lean
|
||||
save Proofs/Audit.lean; save PROVENANCE.json
|
||||
python3 - <<'PY'
|
||||
a = open("Proofs/Audit.lean").read()
|
||||
assert a.count('`fips205.chain_free_loop_eq,') >= 1
|
||||
open("Proofs/Audit.lean","w").write(a.replace('`fips205.chain_free_loop_eq,', '`fips205.chain_free_loop_eq_VANISHED,', 1))
|
||||
PY
|
||||
repin_audit
|
||||
./check.sh > /tmp/sf4.out 2>&1 && fail "ATTACK 4 SUCCEEDED (vanished cert)" /tmp/sf4.out
|
||||
grep -q "NOT FOUND" /tmp/sf4.out || fail "ATTACK 4: rejected but not via the existence check" /tmp/sf4.out
|
||||
restore
|
||||
|
|
@ -131,7 +154,7 @@ restore
|
|||
echo "✓ attack 7 rejected (Phase 0 model-byte integrity)"
|
||||
|
||||
# ── 8: deleted manifest row (round-4 F1, set half) ──────────────────────────
|
||||
save Proofs/Audit.lean
|
||||
save Proofs/Audit.lean; save PROVENANCE.json
|
||||
python3 - <<'PY'
|
||||
import re
|
||||
a = open("Proofs/Audit.lean").read()
|
||||
|
|
@ -139,6 +162,7 @@ new, n = re.subn(r'\n\s*\(`fips205\.to_int_loop_eq,.*?\),', '', a)
|
|||
assert n == 1, f"expected 1 row, removed {n}"
|
||||
open("Proofs/Audit.lean","w").write(new)
|
||||
PY
|
||||
repin_audit
|
||||
./check.sh > /tmp/sf8.out 2>&1 && fail "ATTACK 8 SUCCEEDED (a dropped cert row passed)" /tmp/sf8.out
|
||||
grep -q "digest mismatch" /tmp/sf8.out || fail "ATTACK 8: rejected but not via the digest binding" /tmp/sf8.out
|
||||
restore
|
||||
|
|
@ -152,13 +176,14 @@ echo "✓ attack 8 rejected (audit-manifest digest — a silently-dropped cert c
|
|||
# (which now also rejects a bare `axiom` in an audited module) cannot fire and
|
||||
# the DIGEST must be what bites. `sorryAx` is used as the smuggled name because
|
||||
# admitting it would silently legalise every `sorry` in the repository.
|
||||
save Proofs/Audit.lean
|
||||
save Proofs/Audit.lean; save PROVENANCE.json
|
||||
python3 - <<'PY'
|
||||
a = open("Proofs/Audit.lean").read()
|
||||
old = " kernel3 ++ [oracleF, oracleH, oracleTL, oracleTLen, oracleHMsg]\n"
|
||||
assert a.count(old) == 1, "allowedBoundary shape changed"
|
||||
open("Proofs/Audit.lean","w").write(a.replace(old, old.rstrip("\n") + " ++ [`sorryAx]\n", 1))
|
||||
PY
|
||||
repin_audit
|
||||
./check.sh > /tmp/sf9.out 2>&1 && fail "ATTACK 9 SUCCEEDED: the axiom policy was widened and the button stayed GREEN!" /tmp/sf9.out
|
||||
grep -q "digest mismatch" /tmp/sf9.out || fail "ATTACK 9: rejected but not via the policy-covering digest" /tmp/sf9.out
|
||||
restore
|
||||
|
|
@ -203,13 +228,14 @@ restore
|
|||
echo "✓ attack 11 rejected (enumeration covers every declaration kind, not just theorems)"
|
||||
|
||||
# ── 12: a False-proof inside the AUDITOR itself (round-5 R1) ────────────────
|
||||
save Proofs/Audit.lean
|
||||
save Proofs/Audit.lean; save PROVENANCE.json
|
||||
python3 - <<'PY'
|
||||
a = open("Proofs/Audit.lean").read()
|
||||
i = a.index("elab \"auditCones\"")
|
||||
open("Proofs/Audit.lean","w").write(
|
||||
a[:i] + "axiom cheat12 : ∀ (P : Prop), P\ntheorem audit_proves_false : False := cheat12 _\n\n" + a[i:])
|
||||
PY
|
||||
repin_audit
|
||||
./check.sh > /tmp/sf12.out 2>&1 && fail "ATTACK 12 SUCCEEDED: the auditor itself proves False, still GREEN!" /tmp/sf12.out
|
||||
grep -qE "audit_proves_false|AXIOM DECLARED" /tmp/sf12.out || fail "ATTACK 12: rejected but not via self-enumeration" /tmp/sf12.out
|
||||
restore
|
||||
|
|
@ -240,6 +266,58 @@ grep -q "BUILD HYGIENE FAILED" /tmp/sf14.out || fail "ATTACK 14: rejected but no
|
|||
rm -f Evil.lean
|
||||
echo "✓ attack 14 rejected (no .lean may sit outside gen/ and Proofs/)"
|
||||
|
||||
# ── 16: ORPHAN .olean WITH NO SOURCE (round-6 NEW-8) ───────────────────────
|
||||
# Previously ALL GREEN, digest byte-identical, repo proving False: the round-5
|
||||
# purge covered gen/ and Proofs/ while the stray check greped only *.lean, so a
|
||||
# compiled module with its source DELETED fell between the two — and *.olean is
|
||||
# .gitignored, so `git status` showed only the one-line import.
|
||||
save Proofs/ChainSpec.lean
|
||||
cat > Evil.lean <<'EOF'
|
||||
axiom cheat16 : ∀ (P : Prop), P
|
||||
theorem attack16_false : False := cheat16 _
|
||||
EOF
|
||||
( cd "$AENEAS_HOME/backends/lean" && lake env bash -c \
|
||||
"cd '$HERE' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD/gen:\$PWD\" && lean -o '$HERE/Evil.olean' '$HERE/Evil.lean'" ) >/dev/null 2>&1
|
||||
rm -f Evil.lean # the SOURCE is gone; only the .olean remains
|
||||
printf '\nimport Evil\n' >> Proofs/ChainSpec.lean
|
||||
if [ ! -f Evil.olean ]; then
|
||||
echo " (note: could not build Evil.olean; attack 16 inconclusive)"; rm -f Evil.olean
|
||||
else
|
||||
./check.sh > /tmp/sf16.out 2>&1 && fail "ATTACK 16 SUCCEEDED: an orphan .olean injected False and stayed GREEN!" /tmp/sf16.out
|
||||
# The defense is Phase 0's purge, which now covers ALL of verification/ and so
|
||||
# deletes the orphan BEFORE the stray check ever sees it; `import Evil` then has
|
||||
# nothing to resolve and Phase 2 fails closed. Assert that chain precisely —
|
||||
# the rejection must be the import failure AND the .olean must be gone. (An
|
||||
# earlier revision asserted the hygiene message and failed while the gate was
|
||||
# working correctly: the same wrong-diagnostic defect this suite exists to catch.)
|
||||
grep -q "FAIL: Proofs/ChainSpec" /tmp/sf16.out \
|
||||
|| fail "ATTACK 16: rejected, but not by the purge+import chain" /tmp/sf16.out
|
||||
[ ! -f Evil.olean ] \
|
||||
|| fail "ATTACK 16: check.sh failed but the orphan .olean survived Phase 0" /tmp/sf16.out
|
||||
echo "✓ attack 16 rejected (Phase 0 purges every .olean under verification/, so an"
|
||||
echo " orphan compiled module with no source cannot satisfy an import)"
|
||||
fi
|
||||
restore; rm -f Evil.olean Evil.lean
|
||||
|
||||
# ── 17: TAMPER THE AUDIT'S LOGIC, NOT ITS DATA (round-6 NEW-7) ─────────────
|
||||
# Switching the two fail-closed guards to `unless true` disables every in-Lean
|
||||
# check while leaving the digest BYTE-IDENTICAL — the digest binds the audit's
|
||||
# data, never the code that reads it. Note this attack does NOT re-pin
|
||||
# Audit.lean: the sha256 pin is the only thing standing here, and that is
|
||||
# exactly what is being tested.
|
||||
save Proofs/Audit.lean; save Proofs/ChainSpec.lean
|
||||
python3 - <<'PY'
|
||||
a = open("Proofs/Audit.lean").read()
|
||||
n = a.count(" unless errs.isEmpty do")
|
||||
assert n >= 1, "Audit.lean fail-closed guard shape changed"
|
||||
open("Proofs/Audit.lean","w").write(a.replace(" unless errs.isEmpty do", " unless true do"))
|
||||
PY
|
||||
printf '\n-- SELFTEST ATTACK 17\naxiom cheat17 : ∀ (P : Prop), P\ntheorem attack17_false : False := cheat17 _\n' >> Proofs/ChainSpec.lean
|
||||
./check.sh > /tmp/sf17.out 2>&1 && fail "ATTACK 17 SUCCEEDED: the audit's guards were disabled and it stayed GREEN!" /tmp/sf17.out
|
||||
grep -q "INTEGRITY FAILED" /tmp/sf17.out || fail "ATTACK 17: rejected but not via the Audit.lean harness pin" /tmp/sf17.out
|
||||
restore
|
||||
echo "✓ attack 17 rejected (Phase 0 pins Audit.lean — its LOGIC cannot be silently switched off)"
|
||||
|
||||
# ── 15: COVERAGE OF THE DIGEST INPUT (direct, not an attack) ───────────────
|
||||
# Attack 9 proves the digest binding fires. This proves WHAT it covers: the
|
||||
# hashed block must literally contain each reference fold's definition BODY, so
|
||||
|
|
@ -270,7 +348,7 @@ echo "✓ check 15 passed (the hashed block carries all 12 reference-fold bodies
|
|||
echo ' including the recursive _f companions and their extracted-primitive calls)'
|
||||
|
||||
echo
|
||||
echo "SELFTEST GREEN: 14 attacks rejected + digest-coverage check — dead files, extra axioms, dropped"
|
||||
echo "SELFTEST GREEN: 16 attacks rejected + digest-coverage check — dead files, extra axioms, dropped"
|
||||
echo "oracles, vanished certs, un-manifested False theorems AND defs, gutted"
|
||||
echo "statements, hand-edited models, dropped manifest rows, widened policy,"
|
||||
echo "specification folds redefined to the loop, a False-proof in the auditor,"
|
||||
|
|
|
|||
|
|
@ -50,17 +50,25 @@ echo "==============================="
|
|||
|
||||
# ── Phase 0: build hygiene + model & harness integrity ───────────────────────
|
||||
echo "=== Phase 0: build hygiene + model/harness integrity ==="
|
||||
# (a) Purge every .olean first. Round-5 NEW-4: the button's verdict must depend
|
||||
# on COMMITTED BYTES, never on untracked build state — a stale .olean from a
|
||||
# module that no longer exists (and *.olean is .gitignored, so invisible to
|
||||
# `git status`) could otherwise satisfy an import and go green.
|
||||
find "$HERE/gen" "$HERE/Proofs" -name '*.olean' -delete 2>/dev/null || true
|
||||
# (b) No Lean source may sit outside gen/ and Proofs/. LEAN_PATH includes $PWD,
|
||||
# so a stray verification/*.lean can join the environment ungated (NEW-4).
|
||||
STRAY=$(find "$HERE" -maxdepth 1 -name '*.lean' -printf '%f\n' 2>/dev/null || true)
|
||||
# (a) Purge EVERY .olean under verification/ — round-6 NEW-8: the round-5 purge
|
||||
# covered only gen/ and Proofs/ while the stray check greped only *.lean, so
|
||||
# an ORPHAN `verification/Evil.olean` WITH NO SOURCE AT ALL fell between them,
|
||||
# satisfied an `import Evil`, and went ALL GREEN with the digest untouched
|
||||
# (*.olean is .gitignored, so `git status` showed only the import line).
|
||||
# The verdict must depend on COMMITTED BYTES, never on untracked build state.
|
||||
find "$HERE" -name '*.olean' -delete 2>/dev/null || true
|
||||
# Aeneas also emits `*_Template.lean` scaffolding into gen/ on every
|
||||
# extraction. Those files are UNTRACKED byproducts (a fresh clone has only
|
||||
# the four pinned model files), nothing imports them, and they would
|
||||
# otherwise sit on LEAN_PATH unpinned — the same untracked-state problem.
|
||||
# Remove them here so the gen/ file-set assertion below can be exact.
|
||||
find "$HERE/gen" -name '*_Template.lean' -delete 2>/dev/null || true
|
||||
# (b) No Lean source OR compiled module may sit outside gen/ and Proofs/;
|
||||
# LEAN_PATH includes $PWD, so either can join the environment ungated.
|
||||
STRAY=$(find "$HERE" -maxdepth 1 \( -name '*.lean' -o -name '*.olean' \) -printf '%f\n' 2>/dev/null || true)
|
||||
if [ -n "$STRAY" ]; then
|
||||
echo "$STRAY" | sed 's/^/ ✗ stray Lean source outside gen\/ and Proofs\/: /'
|
||||
echo "BUILD HYGIENE FAILED (a .lean outside the audited directories can join LEAN_PATH)"; exit 1
|
||||
echo "$STRAY" | sed 's/^/ ✗ stray Lean file outside gen\/ and Proofs\/: /'
|
||||
echo "BUILD HYGIENE FAILED (a .lean/.olean outside the audited directories can join LEAN_PATH)"; exit 1
|
||||
fi
|
||||
# (c) sha256-pin the extracted model AND the compiler harness. lean-guard is
|
||||
# repo-tracked and is shelled out to for every compile, so it is part of the
|
||||
|
|
@ -84,6 +92,20 @@ for rel, want in sorted(files.items()):
|
|||
print(f" ✗ {rel}: sha256 {got[:12]} ≠ pinned {want[:12]}"); bad = 1
|
||||
else:
|
||||
print(f" ✓ {rel}")
|
||||
# Round-6 NEW-9: pin gen/ as a SET, not as four names. A new file under gen/ was
|
||||
# neither hashed nor forbidden, while LEAN_PATH contains $PWD/gen — so the
|
||||
# closure's premise ("everything outside certModules is pinned or disclosed")
|
||||
# was not enforced. Any .lean under gen/ must appear in the pin map.
|
||||
pinned_gen = {k for k in files if k.startswith("gen/")}
|
||||
actual_gen = set()
|
||||
for root, _, names in os.walk(os.path.join(here, "gen")):
|
||||
for n in names:
|
||||
if n.endswith(".lean"):
|
||||
actual_gen.add(os.path.relpath(os.path.join(root, n), here))
|
||||
for extra in sorted(actual_gen - pinned_gen):
|
||||
print(f" ✗ UNPINNED model file under gen/: {extra}"); bad = 1
|
||||
for missing in sorted(pinned_gen - actual_gen):
|
||||
print(f" ✗ pinned model file absent: {missing}"); bad = 1
|
||||
sys.exit(1 if bad else 0)
|
||||
PY
|
||||
|
||||
|
|
@ -143,10 +165,19 @@ if [ "$GOT_SHA" != "$EXPECTED_AUDIT_SHA256" ]; then
|
|||
echo " expected: $EXPECTED_AUDIT_SHA256"
|
||||
echo " observed: $GOT_SHA"
|
||||
echo " A policy constant, a certificate statement, or a specification"
|
||||
echo " definition changed without a reviewed rotation. The observed block was"
|
||||
echo " written to verification/.audit-manifest.observed — diff it to see what."
|
||||
echo " definition changed without a reviewed rotation."
|
||||
echo " What moved (committed block vs observed):"
|
||||
diff -u "$HERE/AUDIT-MANIFEST.txt" "$HERE/.audit-manifest.observed" 2>/dev/null \
|
||||
| head -40 | sed 's/^/ /' || echo " (AUDIT-MANIFEST.txt absent — cannot diff)"
|
||||
exit 1
|
||||
fi
|
||||
# The digest's INPUT is committed too (round-6: a mismatch previously wrote an
|
||||
# observed block with nothing to diff it against). Guard against the committed
|
||||
# copy drifting from what Lean actually emits.
|
||||
if ! printf '%s\n' "$BLOCK" | cmp -s - "$HERE/AUDIT-MANIFEST.txt"; then
|
||||
echo "AUDIT FAILED — the committed AUDIT-MANIFEST.txt does not match the emitted block"
|
||||
echo " (digest matched, so this means the committed copy is stale — refresh it)"; exit 1
|
||||
fi
|
||||
echo " ✓ $(grep -oF 'exact-cone audit PASSED' <<<"$AUD_OUT" | head -1)"
|
||||
echo " ✓ audit-manifest digest matches (sha256 ${EXPECTED_AUDIT_SHA256:0:16}…)"
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue