软件加固 PoC 的通过标准应该怎样写

#!/usr/bin/env python3
import hashlib
import json
import re
import sys
from pathlib import Path

SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
ALLOWED_STATUS = {"passed", "failed", "blocked", "not-run", "accepted-limitation"}
ALLOWED_SEVERITY = {"blocker", "major", "advisory"}

def fail(message, code=2):
    print(message, file=sys.stderr)
    raise SystemExit(code)

def sha256_file(path):
    digest = hashlib.sha256()
    with path.open("rb") as handle:
        for block in iter(lambda: handle.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()

def load_json(path):
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
        fail("cannot read PoC plan: " + str(exc))
    if not isinstance(value, dict):
        fail("PoC plan must be a JSON object")
    return value

def require_text(record, field, context):
    value = record.get(field)
    if not isinstance(value, str) or not value.strip():
        fail(context + " is missing " + field)
    return value.strip()

def validate_evidence(item, evidence_root, candidate_sha, criterion_id, findings):
    if not isinstance(item, dict):
        fail(criterion_id + " evidence must be an object")
    if item.get("candidateSha256") != candidate_sha:
        findings.append({"criterionId": criterion_id, "kind": "candidate-mismatch"})
    relative = require_text(item, "artifactPath", criterion_id + " evidence")
    expected_sha = require_text(item, "artifactSha256", criterion_id + " evidence").lower()
    if not SHA256_RE.fullmatch(expected_sha):
        fail(criterion_id + " evidence has invalid artifactSha256")
    artifact = (evidence_root / relative).resolve()
    try:
        artifact.relative_to(evidence_root.resolve())
    except ValueError:
        fail(criterion_id + " evidence escapes evidence root")
    if not artifact.is_file():
        findings.append({"criterionId": criterion_id, "kind": "evidence-missing", "path": relative})
        return
    actual_sha = sha256_file(artifact)
    if actual_sha != expected_sha:
        findings.append({"criterionId": criterion_id, "kind": "evidence-hash-mismatch", "path": relative})

def validate_criterion(record, evidence_root, candidate_sha, seen_ids, matrix_cells, findings):
    if not isinstance(record, dict):
        fail("every criterion must be an object")
    criterion_id = require_text(record, "criterionId", "criterion")
    if criterion_id in seen_ids:
        fail("duplicate criterionId: " + criterion_id)
    seen_ids.add(criterion_id)
    severity = require_text(record, "severity", criterion_id)
    status = require_text(record, "status", criterion_id)
    require_text(record, "scope", criterion_id)
    require_text(record, "expected", criterion_id)
    require_text(record, "retestTrigger", criterion_id)
    if severity not in ALLOWED_SEVERITY:
        fail(criterion_id + " has unsupported severity")
    if status not in ALLOWED_STATUS:
        fail(criterion_id + " has unsupported status")
    cell = require_text(record, "matrixCell", criterion_id)
    matrix_cells.add(cell)
    evidence = record.get("evidence", [])
    if not isinstance(evidence, list):
        fail(criterion_id + " evidence must be an array")
    for item in evidence:
        validate_evidence(item, evidence_root, candidate_sha, criterion_id, findings)
    if status == "passed" and not evidence:
        findings.append({"criterionId": criterion_id, "kind": "passed-without-evidence"})
    if severity == "blocker" and status != "passed":
        findings.append({"criterionId": criterion_id, "kind": "blocker-not-passed", "status": status})
    if status == "accepted-limitation":
        if severity == "blocker":
            findings.append({"criterionId": criterion_id, "kind": "blocker-cannot-be-accepted-limitation"})
        require_text(record, "limitationOwner", criterion_id)
        require_text(record, "approvalRecord", criterion_id)

def main():
    if len(sys.argv) != 3:
        print("Usage: validate_poc_acceptance.py POC_PLAN_JSON EVIDENCE_DIRECTORY", file=sys.stderr)
        raise SystemExit(2)
    plan_path = Path(sys.argv[1])
    evidence_root = Path(sys.argv[2])
    if not plan_path.is_file() or not evidence_root.is_dir():
        print("plan file and evidence directory must exist", file=sys.stderr)
        raise SystemExit(2)
    plan = load_json(plan_path)
    candidate_sha = require_text(plan, "candidateSha256", "plan").lower()
    if not SHA256_RE.fullmatch(candidate_sha):
        fail("candidateSha256 must be 64 lowercase hexadecimal characters")
    criteria = plan.get("criteria")
    required_cells = plan.get("requiredMatrixCells")
    if not isinstance(criteria, list) or not criteria:
        fail("criteria must be a non-empty array")
    if not isinstance(required_cells, list) or not required_cells:
        fail("requiredMatrixCells must be a non-empty array")
    if any(not isinstance(cell, str) or not cell.strip() for cell in required_cells):
        fail("requiredMatrixCells must contain non-empty strings")

    findings = []
    seen_ids = set()
    observed_cells = set()
    for record in criteria:
        validate_criterion(record, evidence_root, candidate_sha, seen_ids, observed_cells, findings)
    for cell in sorted(set(required_cells) - observed_cells):
        findings.append({"criterionId": None, "kind": "required-matrix-cell-missing", "matrixCell": cell})

    result = {
        "status": "blocked" if findings else "acceptance-structure-passed",
        "candidateSha256": candidate_sha,
        "planSha256": sha256_file(plan_path),
        "criterionCount": len(criteria),
        "requiredMatrixCellCount": len(set(required_cells)),
        "findings": findings,
        "boundary": "Structure and hashes passed do not prove the evidence content or product capability.",
    }
    print(json.dumps(result, ensure_ascii=False, indent=2, sort_keys=True))
    if findings:
        raise SystemExit(20)

if __name__ == "__main__":
    main()