2 Commits

Author	SHA1	Message	Date
houseme	8be1e9b2c1	test(scanner): add release bundle evidence descriptors (#7595) ... * test(scanner): merge release evidence descriptors Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(scanner): add authority and legacy release descriptors Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(scanner): add scoped ack release descriptor Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(scanner): require all release evidence fields Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(scanner): add mrf release descriptor producer Add a standalone W13 MRF descriptor producer for measured G07/G08/P4 raw artifacts, with fail-closed self-tests for missing responsibility cases, disk-full ENOSPC observations, synthetic artifacts, and short P4 cleanup soaks. Also bind G12 quota path evidence to explicit case lists so W16 descriptors cannot pass without reset and settlement coverage. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> * test(scanner): reuse mrf release descriptor producer Route the W13 runner through the shared MRF descriptor producer so measured runs and offline re-packaging use the same fail-closed validation. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> --------- Co-authored-by: zhi22915 <qiuzgang@gmail.com>	2026-09-09 22:55:43 +08:00
唐小鸭	1dcdfe4817	build(make): resolve a Python 3.11+ interpreter for guard scripts (#7004) ... scripts/check_test_wiring.py and scripts/check_security_coverage.py import tomllib, which landed in Python 3.11. macOS ships /usr/bin/python3 at 3.9, so `make pre-commit` failed on a clean machine with `ModuleNotFoundError: No module named 'tomllib'` in test-wiring-check, even though the checkers themselves are fine. Add scripts/python_bin.sh, which resolves an interpreter (explicit RUSTFS_PYTHON, then python3.14..3.11/python3/python on PATH, then a `uv run --python 3.12 --no-project` fallback) and execs it, failing with the concrete remediation when nothing usable exists. Route the Make call sites through RUSTFS_PYTHON_BIN. CI workflows keep calling python3 directly because their runners already provide 3.11+.	2026-09-01 19:09:36 +08:00