mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-25 19:03:14 +01:00
Claude
69d706b395
src/Core/Cluster/Crypto implements the wire formats of the extension's cluster API v1 (xcvm_core ADR-002), in plain PHP with sodium and OpenSSL: - Enc: the lp()/u64 canonical encoding. - Box: XCVM-BOX-v1 session bodies. - Seal: XCVM-SEAL-v1 to an X25519 key; refuses the all-zero shared secret and binds purpose and context. - PanelSig: verifies panel signatures against the closed tag registry. - NodeSig: the node key's own signatures, under a separate domain string so they can never pass as panel records. - Canonical: the panel-owned request/response serialisation. It is the BOX context and the MAC input, with a ±90 s window and header parsing. - Ticket, RelayAuth, FileDigest: relay and file tickets, the child's per-connect relay proof, and owner-signed file digests. - ClusterCrypto: a facade over XC_VM::cluster_*. Refusals throw ClusterRefusedException with the extension's reason code. - ClusterCryptoFactory: fails closed (ClusterUnavailableException) without the extension, outside API 1–1, or without sodium/AES-GCM. No PHP fallback ships. Tests: - The panel matches the extension's shared vectors byte for byte (tests/Support/cluster_vectors.json, copied from xcvm_core): SEAL, BOX, panel signatures, the licence binding and CK_B, and the whole token chain an agent runs. - tests/Support/cluster_canonical_vectors.json freezes the canonical request/response bytes for the Go agent. - Also added: SignTagSeparationTest, ClusterTicketsTest, ClusterCryptoFailClosedTest (including a check that nothing under Core/Cluster signs as the panel or computes tokens) and ClusterCryptoBenchTest. - Timing: 64 KB is ~0.25 ms p99 against the 1 ms budget; 8 MB is ~41 ms here against a 40 ms target, guarded at 2x. The reference crypto that only xcvm_core or the Go agent computes (binding, token MAC, session keys, panel signing with a seed) lives in tests/Support and never ships. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Es8UhyPS8MNjuYTagqfGWi
92 lines
2.5 KiB
PHP
92 lines
2.5 KiB
PHP
<?php
|
|
|
|
$projectRoot = dirname(__DIR__);
|
|
$srcRoot = $projectRoot . '/src';
|
|
$flatRoot = $projectRoot;
|
|
|
|
if (file_exists($srcRoot . '/vendor/autoload.php')) {
|
|
$appRoot = $srcRoot;
|
|
} elseif (file_exists($flatRoot . '/vendor/autoload.php')) {
|
|
$appRoot = $flatRoot;
|
|
} else {
|
|
throw new RuntimeException('Unable to locate vendor/autoload.php in expected project paths.');
|
|
}
|
|
|
|
// Silence error_log() diagnostics emitted by exercised code paths (ModuleLoader
|
|
// dependency skips, GitHubReleases version warnings, …) so the test run stays clean.
|
|
// No test asserts on this output; production behaviour is unchanged.
|
|
ini_set('error_log', '/dev/null');
|
|
|
|
$tmpRoot = __DIR__ . '/.tmp';
|
|
$binRoot = $tmpRoot . '/bin';
|
|
|
|
if (!is_dir($tmpRoot)) {
|
|
mkdir($tmpRoot, 0775, true);
|
|
}
|
|
if (!is_dir($binRoot)) {
|
|
mkdir($binRoot, 0775, true);
|
|
}
|
|
|
|
$fakeBinary = $binRoot . '/fake_bin.sh';
|
|
if (!file_exists($fakeBinary)) {
|
|
file_put_contents($fakeBinary, "#!/bin/sh\nexit 0\n");
|
|
chmod($fakeBinary, 0755);
|
|
}
|
|
|
|
if (!defined('MAIN_HOME')) {
|
|
define('MAIN_HOME', $appRoot . '/');
|
|
}
|
|
|
|
if (!defined('PHP_BIN')) {
|
|
define('PHP_BIN', PHP_BINARY);
|
|
}
|
|
// Extra OpenSSL entropy/seed used by Encryption (real value in AppConfig.php).
|
|
// Any stable value works for tests that round-trip encrypt/decrypt.
|
|
if (!defined('OPENSSL_EXTRA')) {
|
|
define('OPENSSL_EXTRA', 'test-openssl-extra');
|
|
}
|
|
// FfmpegPaths::binary() builds paths under BIN_PATH . 'ffmpeg_bin/<ver>/'. No such
|
|
// fixtures exist here, so lookups miss and the code falls back to FFMPEG_BIN_40.
|
|
if (!defined('BIN_PATH')) {
|
|
define('BIN_PATH', $binRoot . '/');
|
|
}
|
|
if (!defined('VOD_PATH')) {
|
|
define('VOD_PATH', $tmpRoot . '/vod/');
|
|
}
|
|
if (!is_dir(VOD_PATH)) {
|
|
mkdir(VOD_PATH, 0775, true);
|
|
}
|
|
|
|
foreach (array('40', '71', '80') as $version) {
|
|
$ffmpegConst = 'FFMPEG_BIN_' . $version;
|
|
$ffprobeConst = 'FFPROBE_BIN_' . $version;
|
|
if (!defined($ffmpegConst)) {
|
|
define($ffmpegConst, $fakeBinary);
|
|
}
|
|
if (!defined($ffprobeConst)) {
|
|
define($ffprobeConst, $fakeBinary);
|
|
}
|
|
}
|
|
|
|
if (!isset($_FILES)) {
|
|
$_FILES = array();
|
|
}
|
|
|
|
if (!function_exists('igbinary_serialize')) {
|
|
function igbinary_serialize($value) {
|
|
return serialize($value);
|
|
}
|
|
}
|
|
if (!function_exists('igbinary_unserialize')) {
|
|
function igbinary_unserialize($value) {
|
|
return unserialize($value);
|
|
}
|
|
}
|
|
|
|
require_once MAIN_HOME . 'vendor/autoload.php';
|
|
require_once __DIR__ . '/Unit/M3uParser/ExtCustomTag.php';
|
|
|
|
// Test support: in-memory SQLite harness for DB-touching repositories/services.
|
|
require_once __DIR__ . '/Support/TestDb.php';
|
|
require_once __DIR__ . '/Support/ClusterReference.php';
|