feat: strengthen BSP and PSP validation and handoff

skills/firmware-lowlevel-psp-development/scripts/psp/test_validate_bsp_handoff.py

@@ -3,8 +3,10 @@
 
 import hashlib
 import json
+import os
 import tempfile
 from pathlib import Path
+from unittest.mock import patch
 
 import validate_bsp_handoff
 
@@ -12,7 +14,8 @@ import validate_bsp_handoff
 def main() -> int:
     with tempfile.TemporaryDirectory() as tmp:
         root = Path(tmp)
-        imgs = root / "imgs" / "20260902_1"
+        output_root = root / "outputs"
+        imgs = output_root / "CV1841CP-BOARD_dualos" / "imgs" / "20260902_1"
         imgs.mkdir(parents=True)
         artifact = imgs / "boot.bin"
         artifact.write_bytes(b"boot")
@@ -66,6 +69,15 @@ def main() -> int:
         margin_path = project / "doc" / "bsp_adaptation" / "validation" / "image_partition_margin_20260902_1.json"
         margin_path.parent.mkdir(parents=True)
         margin_path.write_text(json.dumps(margin), encoding="utf-8")
+        permissions = {
+            "schema_version": 1,
+            "passed": True,
+            "policy": "a+rX",
+            "output_root": str(output_root),
+            "imgs_version_path": str(imgs),
+        }
+        permissions_path = margin_path.parent / "output_permissions_20260902_1.json"
+        permissions_path.write_text(json.dumps(permissions), encoding="utf-8")
         manifest = root / "psp_handoff.json"
         payload = {
             "schema_version": 1,
@@ -86,6 +98,7 @@ def main() -> int:
                 "completion_marker_seen": True,
                 "imgs_version_path": str(imgs),
                 "image_partition_margin_path": str(margin_path),
+                "output_permissions_path": str(permissions_path),
             },
             "artifacts": [
                 {
@@ -98,12 +111,17 @@ def main() -> int:
             ],
             "validation": {
                 "image_partition_margin": margin,
+                "output_permissions": permissions,
                 "hardware": "pending",
                 "owner_acceptance": "pending",
                 "release": "not-authorized",
             },
         }
         manifest.write_text(json.dumps(payload), encoding="utf-8")
+        for directory in (output_root, output_root / "CV1841CP-BOARD_dualos", imgs.parent, imgs):
+            os.chmod(directory, 0o755)
+        for image in (artifact, kernel, rootfs):
+            os.chmod(image, 0o644)
         result = validate_bsp_handoff.validate_handoff(
             manifest,
             "CV1841CP-BOARD_dualos",
@@ -116,9 +134,74 @@ def main() -> int:
         assert result["dependency"]["build_id"] == "20260902_1"
         assert result["dependency"]["chip"] == "CV1841CP"
         assert result["dependency"]["image_partition_margin"]["passed"] is True
+        assert result["dependency"]["output_permissions"]["current_check"]["passed"] is True
         assert result["dependency"]["artifacts"][0]["sha256"]
         assert result["warnings"]
 
+        os.chmod(output_root, 0o700)
+        os.chmod(imgs, 0o700)
+        os.chmod(kernel, 0o600)
+        other_build = root / "another-build"
+        other_build.mkdir(mode=0o700)
+        (imgs / "external-link").symlink_to(other_build, target_is_directory=True)
+        readonly = validate_bsp_handoff.validate_handoff(manifest)
+        assert readonly["passed"] is False
+        assert any("共享读取/进入权限" in error for error in readonly["errors"])
+        assert output_root.stat().st_mode & 0o777 == 0o700
+        repaired = validate_bsp_handoff.validate_handoff(
+            manifest,
+            expected_project="CV1841CP-BOARD_dualos",
+            repair_output_permissions=True,
+        )
+        assert repaired["passed"] is True, repaired
+        assert repaired["dependency"]["output_permissions"]["current_check"]["repaired"] is True
+        assert repaired["dependency"]["output_permissions"]["current_check"]["symlinks_skipped"] == 1
+        assert output_root.stat().st_mode & 0o555 == 0o555
+        assert other_build.stat().st_mode & 0o777 == 0o700
+        assert kernel.stat().st_mode & 0o444 == 0o444
+        assert kernel.stat().st_mode & 0o111 == 0
+
+        no_evidence_payload = json.loads(json.dumps(payload))
+        no_evidence_payload["validation"].pop("output_permissions")
+        no_evidence_manifest = root / "no_permissions_handoff.json"
+        no_evidence_manifest.write_text(json.dumps(no_evidence_payload), encoding="utf-8")
+        no_evidence = validate_bsp_handoff.validate_handoff(
+            no_evidence_manifest,
+            expected_project="CV1841CP-BOARD_dualos",
+            repair_output_permissions=True,
+        )
+        assert no_evidence["passed"] is False
+        assert any("权限证据" in error for error in no_evidence["errors"])
+
+        os.chmod(kernel, 0o600)
+        bad_project = validate_bsp_handoff.validate_handoff(
+            manifest,
+            expected_project="NOT-THE-PROJECT",
+            repair_output_permissions=True,
+        )
+        assert bad_project["passed"] is False
+        assert kernel.stat().st_mode & 0o444 != 0o444
+        bad_evidence_payload = json.loads(json.dumps(payload))
+        bad_evidence_payload["validation"]["output_permissions"]["output_root"] = str(root / "wrong-root")
+        bad_evidence_manifest = root / "bad_permissions_handoff.json"
+        bad_evidence_manifest.write_text(json.dumps(bad_evidence_payload), encoding="utf-8")
+        bad_evidence = validate_bsp_handoff.validate_handoff(
+            bad_evidence_manifest,
+            expected_project="CV1841CP-BOARD_dualos",
+            repair_output_permissions=True,
+        )
+        assert bad_evidence["passed"] is False
+        assert kernel.stat().st_mode & 0o444 != 0o444
+        with patch.object(validate_bsp_handoff.os, "chmod", side_effect=PermissionError("denied")):
+            unrepairable = validate_bsp_handoff.validate_handoff(
+                manifest,
+                expected_project="CV1841CP-BOARD_dualos",
+                repair_output_permissions=True,
+            )
+        assert unrepairable["passed"] is False
+        assert any("无法检查或修复" in error for error in unrepairable["errors"])
+        os.chmod(kernel, 0o644)
+
         missing_margin_payload = json.loads(json.dumps(payload))
         missing_margin_payload["validation"].pop("image_partition_margin")
         missing_margin_payload["build"].pop("image_partition_margin_path")