|
| 1 | +#!/usr/bin/env bash |
| 2 | +# generate-witness-bundle.sh — Create a self-contained RVF witness bundle |
| 3 | +# |
| 4 | +# Produces: witness-bundle-ADR028-<commit>.tar.gz |
| 5 | +# Contains: witness log, ADR, proof hash, test results, firmware manifest, |
| 6 | +# reference signal metadata, and a VERIFY.sh script for recipients. |
| 7 | +# |
| 8 | +# Usage: bash scripts/generate-witness-bundle.sh |
| 9 | + |
| 10 | +set -euo pipefail |
| 11 | + |
| 12 | +REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)" |
| 13 | +COMMIT_SHA="$(git -C "$REPO_ROOT" rev-parse HEAD)" |
| 14 | +SHORT_SHA="${COMMIT_SHA:0:8}" |
| 15 | +BUNDLE_NAME="witness-bundle-ADR028-${SHORT_SHA}" |
| 16 | +BUNDLE_DIR="$REPO_ROOT/dist/${BUNDLE_NAME}" |
| 17 | +TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" |
| 18 | + |
| 19 | +echo "================================================================" |
| 20 | +echo " WiFi-DensePose Witness Bundle Generator (ADR-028)" |
| 21 | +echo "================================================================" |
| 22 | +echo " Commit: ${COMMIT_SHA}" |
| 23 | +echo " Time: ${TIMESTAMP}" |
| 24 | +echo "" |
| 25 | + |
| 26 | +# Create bundle directory |
| 27 | +rm -rf "$BUNDLE_DIR" |
| 28 | +mkdir -p "$BUNDLE_DIR" |
| 29 | + |
| 30 | +# --------------------------------------------------------------- |
| 31 | +# 1. Copy witness documents |
| 32 | +# --------------------------------------------------------------- |
| 33 | +echo "[1/7] Copying witness documents..." |
| 34 | +cp "$REPO_ROOT/docs/WITNESS-LOG-028.md" "$BUNDLE_DIR/" |
| 35 | +cp "$REPO_ROOT/docs/adr/ADR-028-esp32-capability-audit.md" "$BUNDLE_DIR/" |
| 36 | + |
| 37 | +# --------------------------------------------------------------- |
| 38 | +# 2. Copy proof system |
| 39 | +# --------------------------------------------------------------- |
| 40 | +echo "[2/7] Copying proof system..." |
| 41 | +mkdir -p "$BUNDLE_DIR/proof" |
| 42 | +cp "$REPO_ROOT/v1/data/proof/verify.py" "$BUNDLE_DIR/proof/" |
| 43 | +cp "$REPO_ROOT/v1/data/proof/expected_features.sha256" "$BUNDLE_DIR/proof/" |
| 44 | +cp "$REPO_ROOT/v1/data/proof/generate_reference_signal.py" "$BUNDLE_DIR/proof/" |
| 45 | +# Reference signal is large (~10 MB) — include metadata only |
| 46 | +python3 -c " |
| 47 | +import json, os |
| 48 | +with open('$REPO_ROOT/v1/data/proof/sample_csi_data.json') as f: |
| 49 | + d = json.load(f) |
| 50 | +meta = {k: v for k, v in d.items() if k != 'frames'} |
| 51 | +meta['frame_count'] = len(d['frames']) |
| 52 | +meta['first_frame_keys'] = list(d['frames'][0].keys()) |
| 53 | +meta['file_size_bytes'] = os.path.getsize('$REPO_ROOT/v1/data/proof/sample_csi_data.json') |
| 54 | +with open('$BUNDLE_DIR/proof/reference_signal_metadata.json', 'w') as f: |
| 55 | + json.dump(meta, f, indent=2) |
| 56 | +" 2>/dev/null && echo " Reference signal metadata extracted." || echo " (Python not available — metadata skipped)" |
| 57 | + |
| 58 | +# --------------------------------------------------------------- |
| 59 | +# 3. Run Rust tests and capture output |
| 60 | +# --------------------------------------------------------------- |
| 61 | +echo "[3/7] Running Rust test suite..." |
| 62 | +mkdir -p "$BUNDLE_DIR/test-results" |
| 63 | +cd "$REPO_ROOT/rust-port/wifi-densepose-rs" |
| 64 | +cargo test --workspace --no-default-features 2>&1 | tee "$BUNDLE_DIR/test-results/rust-workspace-tests.log" | tail -5 |
| 65 | +# Extract summary |
| 66 | +grep "^test result" "$BUNDLE_DIR/test-results/rust-workspace-tests.log" | \ |
| 67 | + awk '{p+=$4; f+=$6; i+=$8} END {printf "TOTAL: %d passed, %d failed, %d ignored\n", p, f, i}' \ |
| 68 | + > "$BUNDLE_DIR/test-results/summary.txt" |
| 69 | +cat "$BUNDLE_DIR/test-results/summary.txt" |
| 70 | +cd "$REPO_ROOT" |
| 71 | + |
| 72 | +# --------------------------------------------------------------- |
| 73 | +# 4. Run Python proof verification |
| 74 | +# --------------------------------------------------------------- |
| 75 | +echo "[4/7] Running Python proof verification..." |
| 76 | +python3 "$REPO_ROOT/v1/data/proof/verify.py" 2>&1 | tee "$BUNDLE_DIR/proof/verification-output.log" | tail -5 || true |
| 77 | + |
| 78 | +# --------------------------------------------------------------- |
| 79 | +# 5. Firmware manifest |
| 80 | +# --------------------------------------------------------------- |
| 81 | +echo "[5/7] Generating firmware manifest..." |
| 82 | +mkdir -p "$BUNDLE_DIR/firmware-manifest" |
| 83 | +if [ -d "$REPO_ROOT/firmware/esp32-csi-node/main" ]; then |
| 84 | + wc -l "$REPO_ROOT/firmware/esp32-csi-node/main/"*.c "$REPO_ROOT/firmware/esp32-csi-node/main/"*.h \ |
| 85 | + > "$BUNDLE_DIR/firmware-manifest/source-line-counts.txt" 2>/dev/null || true |
| 86 | + # SHA-256 of each firmware source file |
| 87 | + sha256sum "$REPO_ROOT/firmware/esp32-csi-node/main/"*.c "$REPO_ROOT/firmware/esp32-csi-node/main/"*.h \ |
| 88 | + > "$BUNDLE_DIR/firmware-manifest/source-hashes.txt" 2>/dev/null || \ |
| 89 | + find "$REPO_ROOT/firmware/esp32-csi-node/main/" -type f \( -name "*.c" -o -name "*.h" \) -exec sha256sum {} \; \ |
| 90 | + > "$BUNDLE_DIR/firmware-manifest/source-hashes.txt" 2>/dev/null || true |
| 91 | + echo " Firmware source files hashed." |
| 92 | +else |
| 93 | + echo " (No firmware directory found — skipped)" |
| 94 | +fi |
| 95 | + |
| 96 | +# --------------------------------------------------------------- |
| 97 | +# 6. Crate manifest |
| 98 | +# --------------------------------------------------------------- |
| 99 | +echo "[6/7] Generating crate manifest..." |
| 100 | +mkdir -p "$BUNDLE_DIR/crate-manifest" |
| 101 | +for crate_dir in "$REPO_ROOT/rust-port/wifi-densepose-rs/crates/"*/; do |
| 102 | + crate_name="$(basename "$crate_dir")" |
| 103 | + if [ -f "$crate_dir/Cargo.toml" ]; then |
| 104 | + version=$(grep '^version' "$crate_dir/Cargo.toml" | head -1 | sed 's/.*"\(.*\)".*/\1/') |
| 105 | + echo "${crate_name} = ${version}" >> "$BUNDLE_DIR/crate-manifest/versions.txt" |
| 106 | + fi |
| 107 | +done |
| 108 | +cat "$BUNDLE_DIR/crate-manifest/versions.txt" |
| 109 | + |
| 110 | +# --------------------------------------------------------------- |
| 111 | +# 7. Generate VERIFY.sh for recipients |
| 112 | +# --------------------------------------------------------------- |
| 113 | +echo "[7/7] Creating VERIFY.sh..." |
| 114 | +cat > "$BUNDLE_DIR/VERIFY.sh" << 'VERIFY_EOF' |
| 115 | +#!/usr/bin/env bash |
| 116 | +# VERIFY.sh — Recipient verification script for WiFi-DensePose Witness Bundle |
| 117 | +# |
| 118 | +# Run this script after cloning the repository at the witnessed commit. |
| 119 | +# It re-runs all verification steps and compares against the bundled results. |
| 120 | +set -euo pipefail |
| 121 | +
|
| 122 | +echo "================================================================" |
| 123 | +echo " WiFi-DensePose Witness Bundle Verification" |
| 124 | +echo "================================================================" |
| 125 | +echo "" |
| 126 | +
|
| 127 | +PASS_COUNT=0 |
| 128 | +FAIL_COUNT=0 |
| 129 | +
|
| 130 | +check() { |
| 131 | + local desc="$1" result="$2" |
| 132 | + if [ "$result" = "PASS" ]; then |
| 133 | + echo " [PASS] $desc" |
| 134 | + PASS_COUNT=$((PASS_COUNT + 1)) |
| 135 | + else |
| 136 | + echo " [FAIL] $desc" |
| 137 | + FAIL_COUNT=$((FAIL_COUNT + 1)) |
| 138 | + fi |
| 139 | +} |
| 140 | +
|
| 141 | +# Check 1: Witness documents exist |
| 142 | +[ -f "WITNESS-LOG-028.md" ] && check "Witness log present" "PASS" || check "Witness log present" "FAIL" |
| 143 | +[ -f "ADR-028-esp32-capability-audit.md" ] && check "ADR-028 present" "PASS" || check "ADR-028 present" "FAIL" |
| 144 | +
|
| 145 | +# Check 2: Proof hash file |
| 146 | +[ -f "proof/expected_features.sha256" ] && check "Proof hash file present" "PASS" || check "Proof hash file present" "FAIL" |
| 147 | +echo " Expected hash: $(cat proof/expected_features.sha256 2>/dev/null || echo 'NOT FOUND')" |
| 148 | +
|
| 149 | +# Check 3: Test results |
| 150 | +if [ -f "test-results/summary.txt" ]; then |
| 151 | + summary="$(cat test-results/summary.txt)" |
| 152 | + echo " Test summary: $summary" |
| 153 | + if echo "$summary" | grep -q "0 failed"; then |
| 154 | + check "All Rust tests passed" "PASS" |
| 155 | + else |
| 156 | + check "All Rust tests passed" "FAIL" |
| 157 | + fi |
| 158 | +else |
| 159 | + check "Test results present" "FAIL" |
| 160 | +fi |
| 161 | +
|
| 162 | +# Check 4: Firmware manifest |
| 163 | +if [ -f "firmware-manifest/source-hashes.txt" ]; then |
| 164 | + count=$(wc -l < firmware-manifest/source-hashes.txt) |
| 165 | + check "Firmware source hashes (${count} files)" "PASS" |
| 166 | +else |
| 167 | + check "Firmware manifest present" "FAIL" |
| 168 | +fi |
| 169 | +
|
| 170 | +# Check 5: Crate versions |
| 171 | +if [ -f "crate-manifest/versions.txt" ]; then |
| 172 | + count=$(wc -l < crate-manifest/versions.txt) |
| 173 | + check "Crate manifest (${count} crates)" "PASS" |
| 174 | +else |
| 175 | + check "Crate manifest present" "FAIL" |
| 176 | +fi |
| 177 | +
|
| 178 | +# Check 6: Proof verification log |
| 179 | +if [ -f "proof/verification-output.log" ]; then |
| 180 | + if grep -q "VERDICT: PASS" proof/verification-output.log; then |
| 181 | + check "Python proof verification PASS" "PASS" |
| 182 | + else |
| 183 | + check "Python proof verification PASS" "FAIL" |
| 184 | + fi |
| 185 | +else |
| 186 | + check "Proof verification log present" "FAIL" |
| 187 | +fi |
| 188 | +
|
| 189 | +echo "" |
| 190 | +echo "================================================================" |
| 191 | +echo " Results: ${PASS_COUNT} passed, ${FAIL_COUNT} failed" |
| 192 | +if [ "$FAIL_COUNT" -eq 0 ]; then |
| 193 | + echo " VERDICT: ALL CHECKS PASSED" |
| 194 | +else |
| 195 | + echo " VERDICT: ${FAIL_COUNT} CHECK(S) FAILED — investigate" |
| 196 | +fi |
| 197 | +echo "================================================================" |
| 198 | +VERIFY_EOF |
| 199 | +chmod +x "$BUNDLE_DIR/VERIFY.sh" |
| 200 | + |
| 201 | +# --------------------------------------------------------------- |
| 202 | +# Create manifest with all file hashes |
| 203 | +# --------------------------------------------------------------- |
| 204 | +echo "" |
| 205 | +echo "Generating bundle manifest..." |
| 206 | +cd "$BUNDLE_DIR" |
| 207 | +find . -type f -not -name "MANIFEST.sha256" | sort | while read -r f; do |
| 208 | + sha256sum "$f" |
| 209 | +done > MANIFEST.sha256 2>/dev/null || \ |
| 210 | +find . -type f -not -name "MANIFEST.sha256" | sort -exec sha256sum {} \; > MANIFEST.sha256 2>/dev/null || true |
| 211 | + |
| 212 | +# --------------------------------------------------------------- |
| 213 | +# Package as tarball |
| 214 | +# --------------------------------------------------------------- |
| 215 | +echo "Packaging bundle..." |
| 216 | +cd "$REPO_ROOT/dist" |
| 217 | +tar czf "${BUNDLE_NAME}.tar.gz" "${BUNDLE_NAME}/" |
| 218 | +BUNDLE_SIZE=$(du -h "${BUNDLE_NAME}.tar.gz" | cut -f1) |
| 219 | + |
| 220 | +echo "" |
| 221 | +echo "================================================================" |
| 222 | +echo " Bundle created: dist/${BUNDLE_NAME}.tar.gz (${BUNDLE_SIZE})" |
| 223 | +echo " Contents:" |
| 224 | +find "${BUNDLE_NAME}" -type f | sort | sed 's/^/ /' |
| 225 | +echo "" |
| 226 | +echo " To verify: cd ${BUNDLE_NAME} && bash VERIFY.sh" |
| 227 | +echo "================================================================" |
0 commit comments