feat: strengthen BSP and PSP validation and handoff

skills/firmware-lowlevel-bsp-development/scripts/bsp/test_bsp_build_handoff.py

@@ -3,8 +3,11 @@
 
 import hashlib
 import json
+import os
+import stat
 import tempfile
 from pathlib import Path
+from unittest.mock import patch
 
 import bsp_preflight
 import project_guard
@@ -72,6 +75,19 @@ def main() -> int:
         kernel.write_bytes(b"k" * (512 * 1024))
         rootfs = output / "rootfs.bin"
         rootfs.write_bytes(b"r" * (256 * 1024))
+        helper_dir = output / "tools"
+        helper_dir.mkdir()
+        helper = helper_dir / "inspect.sh"
+        helper.write_text("#!/bin/sh\n", encoding="utf-8")
+        os.chmod(output_root, 0o700)
+        os.chmod(output_root / reference.name, 0o700)
+        os.chmod(output_root / reference.name / "imgs", 0o700)
+        os.chmod(output, 0o700)
+        os.chmod(helper_dir, 0o700)
+        os.chmod(boot, 0o600)
+        os.chmod(kernel, 0o640)
+        os.chmod(rootfs, 0o600)
+        os.chmod(helper, 0o700)
         conflict = bsp_preflight.build_preflight(
             reference.name, "20260902_1", root, output_root
         )
@@ -95,6 +111,21 @@ def main() -> int:
         assert recorded["passed"] is True, recorded
         assert recorded["imgs_version_path"] == str(output.resolve())
         assert recorded["image_partition_margin"]["passed"] is True
+        assert recorded["output_permissions"]["passed"] is True
+        assert recorded["output_permissions"]["policy"] == "a+rX"
+        assert recorded["output_permissions"]["changed_count"] >= 1
+        for directory in (
+            output_root,
+            output_root / reference.name,
+            output_root / reference.name / "imgs",
+            output,
+            helper_dir,
+        ):
+            assert stat.S_IMODE(directory.stat().st_mode) & 0o555 == 0o555
+        for artifact in (boot, kernel, rootfs, helper):
+            assert stat.S_IMODE(artifact.stat().st_mode) & 0o444 == 0o444
+        assert stat.S_IMODE(boot.stat().st_mode) & 0o111 == 0
+        assert stat.S_IMODE(helper.stat().st_mode) & 0o111 == 0o111
         handoff_path = Path(recorded["psp_handoff_path"])
         handoff = json.loads(handoff_path.read_text(encoding="utf-8"))
         assert handoff["handoff_type"] == "bsp-to-psp"
@@ -109,10 +140,24 @@ def main() -> int:
         assert kernel_check["actual_margin_bytes"] == 512 * 1024
         assert kernel_check["effective_partition_size_bytes"] == 1024 * 1024
         assert Path(recorded["image_partition_margin_path"]).is_file()
+        assert Path(recorded["output_permissions_path"]).is_file()
+        assert handoff["validation"]["output_permissions"]["passed"] is True
+        assert handoff["build"]["output_permissions_path"] == recorded["output_permissions_path"]
         assert handoff["consumer_contract"]["select_latest_directory"] is False
         assert handoff["artifacts"][0]["sha256"] == hashlib.sha256(boot.read_bytes()).hexdigest()
         assert handoff["validation"]["hardware"] == "pending"
 
+        linked_output_root = Path(tmp) / "linked-output"
+        linked_output_root.symlink_to(output_root, target_is_directory=True)
+        try:
+            record_build_handoff.record_handoff(
+                reference.name, "20260902_1", 0, True, root, linked_output_root, None, []
+            )
+        except project_guard.GuardError as exc:
+            assert "输出根目录是软链接" in str(exc)
+        else:
+            raise AssertionError("linked output root must not be granted permissions")
+
         overflow_output = output_root / reference.name / "imgs" / "20260902_2"
         overflow_output.mkdir(parents=True)
         (overflow_output / "boot.bin").write_bytes(b"boot")
@@ -141,6 +186,41 @@ def main() -> int:
             / "image_partition_margin_20260902_2.json"
         ).exists()
 
+        denied_output = output_root / reference.name / "imgs" / "20260902_3"
+        denied_output.mkdir(parents=True)
+        denied_boot = denied_output / "boot.bin"
+        denied_boot.write_bytes(b"boot")
+        (denied_output / "kernel.bin").write_bytes(b"k" * (512 * 1024))
+        (denied_output / "rootfs.bin").write_bytes(b"r" * (256 * 1024))
+        os.chmod(denied_boot, 0o600)
+        with patch.object(
+            record_build_handoff.os,
+            "chmod",
+            side_effect=PermissionError(13, "permission denied"),
+        ):
+            try:
+                record_build_handoff.record_handoff(
+                    reference.name,
+                    "20260902_3",
+                    0,
+                    True,
+                    root,
+                    output_root,
+                    None,
+                    [],
+                )
+            except project_guard.GuardError as exc:
+                assert "无法设置构建输出权限" in str(exc)
+            else:
+                raise AssertionError("permission failure must block BSP handoff")
+        assert not (
+            reference
+            / "doc"
+            / "bsp_adaptation"
+            / "validation"
+            / "output_permissions_20260902_3.json"
+        ).exists()
+
         original_partition = (
             reference
             / "configs"