@vigolium/piolium 0.0.1

package/skills/zeroize-audit/tools/diff_rust_mir.sh

@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+# diff_rust_mir.sh — Normalize and diff Rust MIR across optimization levels.
+#
+# Compares MIR output from different optimization levels to detect zeroize-
+# related transformations: drop glue removal, StorageDead elimination, and
+# zeroize call elimination.
+#
+# Exit codes:
+#   0  all files are identical after normalization
+#   1  at least one diff found (or wipe patterns disappeared)
+#   2  argument error
+#
+# Usage (two-file, backward-compatible):
+#   diff_rust_mir.sh <O0.mir> <O2.mir>
+#
+# Usage (multi-level — recommended):
+#   diff_rust_mir.sh <O0.mir> <O1.mir> <O2.mir> [<O3.mir> ...]
+#
+# Output:
+# - Unified diff for each pair of adjacent files.
+# - For 3+ files, a ZEROIZE PATTERN SUMMARY identifying the first opt level
+#   at which patterns disappear.
+#
+# Wipe patterns detected:
+#   zeroize::, Zeroize::zeroize, volatile_set_memory, drop_in_place,
+#   StorageDead for sensitive locals, ptr::write_bytes
+
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  diff_rust_mir.sh <baseline.mir> <file2.mir> [<file3.mir> ...]
+
+Compares Rust MIR files across optimization levels. Normalizes away noisy
+metadata (source locations, scope info, storage annotations) and diffs
+the semantic content. Detects disappearance of zeroize-related patterns.
+
+Examples:
+  diff_rust_mir.sh crate.O0.mir crate.O2.mir
+  diff_rust_mir.sh crate.O0.mir crate.O1.mir crate.O2.mir crate.O3.mir
+EOF
+}
+
+if [[ $# -lt 2 ]]; then
+  usage
+  exit 2
+fi
+
+for f in "$@"; do
+  if [[ ! -f "$f" ]]; then
+    echo "diff_rust_mir.sh: missing file: $f" >&2
+    exit 2
+  fi
+done
+
+# ---------------------------------------------------------------------------
+# Normalization: strip noisy metadata that changes between opt levels
+# but is semantically irrelevant for zeroize analysis.
+# ---------------------------------------------------------------------------
+norm() {
+  sed -E \
+    -e '/^\/\/ WARNING:/d' \
+    -e '/^\/\/ MIR for/d' \
+    -e 's/scope [0-9]+ at [^ ]+:[0-9]+:[0-9]+/scope N at <loc>/g' \
+    -e 's/at [^ ]+\.rs:[0-9]+:[0-9]+/at <loc>/g' \
+    -e 's/\/\/ .*$//g' \
+    -e '/^\s*$/d'
+}
+
+# ---------------------------------------------------------------------------
+# Pattern detection: Rust MIR zeroize-related constructs
+# ---------------------------------------------------------------------------
+has_zeroize_pattern() {
+  grep -qE \
+    'zeroize::|Zeroize::zeroize|volatile_set_memory|ptr::write_bytes|drop_in_place.*[Kk]ey|drop_in_place.*[Ss]ecret|drop_in_place.*[Pp]assword|drop_in_place.*[Tt]oken|drop_in_place.*[Nn]once|drop_in_place.*[Ss]eed|drop_in_place.*[Pp]riv|Zeroizing|ZeroizeOnDrop' \
+    "$1"
+}
+
+has_drop_glue() {
+  grep -qE 'drop_in_place|drop\(_[0-9]+\)' "$1"
+}
+
+# shellcheck disable=SC2329,SC2317 # invoked indirectly by agent prompts
+has_storage_dead_sensitive() {
+  grep -qE 'StorageDead\(_[0-9]+\)' "$1" &&
+    grep -qE '(key|secret|password|token|nonce|seed|priv|master|credential)' "$1"
+}
+
+# ---------------------------------------------------------------------------
+# Setup
+# ---------------------------------------------------------------------------
+FILES=("$@")
+NUM_FILES=${#FILES[@]}
+
+TMPDIR_BASE="$(mktemp -d -t za-mir-XXXXXX)"
+trap 'rm -rf "$TMPDIR_BASE"' EXIT
+
+NORMFILES=()
+for i in "${!FILES[@]}"; do
+  tmp="$TMPDIR_BASE/norm_${i}.mir"
+  norm <"${FILES[$i]}" >"$tmp"
+  NORMFILES+=("$tmp")
+done
+
+# ---------------------------------------------------------------------------
+# Two-file mode: backward-compatible, single diff, no summary.
+# ---------------------------------------------------------------------------
+if [[ $NUM_FILES -eq 2 ]]; then
+  diff_rc=0
+  diff -u "${NORMFILES[0]}" "${NORMFILES[1]}" || diff_rc=$?
+  if [[ $diff_rc -eq 2 ]]; then
+    echo "diff_rust_mir.sh: diff failed (internal error)" >&2
+    exit 1
+  fi
+  exit $diff_rc
+fi
+
+# ---------------------------------------------------------------------------
+# Multi-file mode: pairwise diffs + zeroize pattern summary.
+# ---------------------------------------------------------------------------
+any_diff=0
+
+for ((i = 0; i < NUM_FILES - 1; i++)); do
+  j=$((i + 1))
+  A_LABEL="$(basename "${FILES[$i]}")"
+  B_LABEL="$(basename "${FILES[$j]}")"
+  echo "=== DIFF File $((i + 1)) ($A_LABEL) vs File $((j + 1)) ($B_LABEL) ==="
+  if ! diff -u --label "$A_LABEL" --label "$B_LABEL" \
+    "${NORMFILES[$i]}" "${NORMFILES[$j]}"; then
+    any_diff=1
+  fi
+  echo ""
+done
+
+# ---------------------------------------------------------------------------
+# Zeroize pattern summary
+# ---------------------------------------------------------------------------
+echo "=== ZEROIZE PATTERN SUMMARY ==="
+first_absent=-1
+for i in "${!NORMFILES[@]}"; do
+  LABEL="$(basename "${FILES[$i]}")"
+  if has_zeroize_pattern "${NORMFILES[$i]}"; then
+    echo "  File $((i + 1)) ($LABEL): ZEROIZE CALLS PRESENT"
+  else
+    echo "  File $((i + 1)) ($LABEL): ZEROIZE CALLS ABSENT"
+    if [[ $first_absent -eq -1 ]]; then
+      first_absent=$i
+    fi
+  fi
+done
+echo ""
+
+# ---------------------------------------------------------------------------
+# Drop glue summary
+# ---------------------------------------------------------------------------
+echo "=== DROP GLUE SUMMARY ==="
+first_drop_absent=-1
+for i in "${!NORMFILES[@]}"; do
+  LABEL="$(basename "${FILES[$i]}")"
+  if has_drop_glue "${NORMFILES[$i]}"; then
+    echo "  File $((i + 1)) ($LABEL): DROP GLUE PRESENT"
+  else
+    echo "  File $((i + 1)) ($LABEL): DROP GLUE ABSENT"
+    if [[ $first_drop_absent -eq -1 ]]; then
+      first_drop_absent=$i
+    fi
+  fi
+done
+echo ""
+
+# ---------------------------------------------------------------------------
+# Verdict
+# ---------------------------------------------------------------------------
+if [[ $first_absent -ne -1 ]]; then
+  LABEL="$(basename "${FILES[$first_absent]}")"
+  echo "WARNING: Zeroize patterns first disappear at File $((first_absent + 1)) ($LABEL)."
+  echo "  Evidence: OPTIMIZED_AWAY_ZEROIZE — zeroize calls present at lower opt level(s) but absent here."
+  any_diff=1
+elif [[ $first_drop_absent -ne -1 ]]; then
+  LABEL="$(basename "${FILES[$first_drop_absent]}")"
+  echo "WARNING: Drop glue first disappears at File $((first_drop_absent + 1)) ($LABEL)."
+  echo "  Evidence: Drop glue present at lower opt level(s) but absent here — sensitive type drop may be inlined or elided."
+  any_diff=1
+else
+  echo "OK: Zeroize patterns and drop glue present at all opt levels analyzed."
+fi
+
+exit $any_diff

package/skills/zeroize-audit/tools/emit_asm.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Emit assembly for a given translation unit.
+#
+# Usage:
+#   emit_asm.sh --cc clang --src path/to/file.c --out /tmp/file.s --opt O2 -- <extra compile args>
+
+usage() {
+  echo "Usage: $0 --src <file> --out <out.s> [--cc clang] [--opt O0|O1|O2|O3|Os|Oz] -- <extra args>" >&2
+}
+
+CC="clang"
+SRC=""
+OUT=""
+OPT="O0"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --cc)
+      CC="$2"
+      shift 2
+      ;;
+    --src)
+      SRC="$2"
+      shift 2
+      ;;
+    --out)
+      OUT="$2"
+      shift 2
+      ;;
+    --opt)
+      OPT="$2"
+      shift 2
+      ;;
+    --)
+      shift
+      break
+      ;;
+    *)
+      echo "Unknown arg: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$SRC" || -z "$OUT" ]]; then
+  usage
+  exit 2
+fi
+
+case "$OPT" in
+  O0 | O1 | O2 | O3 | Os | Oz) ;;
+  *)
+    echo "Invalid --opt: $OPT" >&2
+    usage
+    exit 2
+    ;;
+esac
+
+EXTRA=("$@")
+mkdir -p "$(dirname "$OUT")"
+
+"$CC" "-$OPT" -S "$SRC" -o "$OUT" ${EXTRA[@]+"${EXTRA[@]}"}
+
+echo "OK: wrote asm to $OUT"

package/skills/zeroize-audit/tools/emit_ir.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Emit LLVM IR for a given translation unit.
+#
+# Usage:
+#   emit_ir.sh --cc clang --src path/to/file.c --out /tmp/file.ll --opt O2 -- <extra compile args>
+#
+# Notes:
+# - Use `--` to pass through extra include/define flags.
+# - We intentionally do not attempt to parse compile_commands.json here.
+#   Your runner should extract the TU command and pass flags after `--`.
+
+usage() {
+  echo "Usage: $0 --src <file> --out <out.ll> [--cc clang] [--opt O0|O1|O2|O3|Os|Oz] -- <extra args>" >&2
+}
+
+CC="clang"
+SRC=""
+OUT=""
+OPT="O0"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --cc)
+      CC="$2"
+      shift 2
+      ;;
+    --src)
+      SRC="$2"
+      shift 2
+      ;;
+    --out)
+      OUT="$2"
+      shift 2
+      ;;
+    --opt)
+      OPT="$2"
+      shift 2
+      ;;
+    --)
+      shift
+      break
+      ;;
+    *)
+      echo "Unknown arg: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$SRC" || -z "$OUT" ]]; then
+  usage
+  exit 2
+fi
+
+# Normalize OPT -> clang flag
+case "$OPT" in
+  O0 | O1 | O2 | O3 | Os | Oz) ;;
+  *)
+    echo "Invalid --opt: $OPT" >&2
+    usage
+    exit 2
+    ;;
+esac
+
+# Extra args after --
+EXTRA=("$@")
+
+# Ensure output dir exists
+mkdir -p "$(dirname "$OUT")"
+
+# Emit IR
+"$CC" "-$OPT" -S -emit-llvm "$SRC" -o "$OUT" ${EXTRA[@]+"${EXTRA[@]}"}
+
+echo "OK: wrote IR to $OUT"

package/skills/zeroize-audit/tools/emit_rust_asm.sh

@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+# emit_rust_asm.sh — Emit Rust assembly for zeroize analysis.
+#
+# Exit codes:
+#   0  success
+#   1  build/output failure
+#   2  argument error
+
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  emit_rust_asm.sh --manifest <Cargo.toml> --out <path> [options] [-- <extra cargo rustc args>]
+
+Options:
+  --manifest <file>        Cargo manifest path (required)
+  --out <path>             Output .s file or directory (required)
+  --opt <O0|O1|O2|O3>      Opt level (default: O2)
+  --crate <pkg>            Workspace package (-p)
+  --bin <target>           Build only a specific bin target
+  --lib                    Build only the lib target
+  --target <triple>        Cross-compile target (e.g. x86_64-unknown-linux-gnu)
+  --intel-syntax           Emit Intel syntax instead of AT&T (default: AT&T)
+  --help                   Show this help text
+
+Examples:
+  emit_rust_asm.sh --manifest Cargo.toml --opt O2 --out /tmp/crate.O2.s
+  emit_rust_asm.sh --manifest Cargo.toml --opt O0 --out /tmp/asm/ --lib
+  emit_rust_asm.sh --manifest Cargo.toml --out /tmp/crate.O2.s --crate mycrate --target x86_64-unknown-linux-gnu
+EOF
+}
+
+die_arg() {
+  echo "emit_rust_asm.sh: $*" >&2
+  exit 2
+}
+
+die_run() {
+  echo "emit_rust_asm.sh: $*" >&2
+  exit 1
+}
+
+require_value() {
+  local opt="$1"
+  local val="${2-}"
+  [[ -n "$val" ]] || die_arg "missing value for ${opt}"
+}
+
+MANIFEST=""
+OUT=""
+OPT="O2"
+CRATE=""
+BIN_TARGET=""
+LIB_TARGET=false
+TARGET_TRIPLE=""
+INTEL_SYNTAX=false
+EXTRA_ARGS=()
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --manifest)
+      require_value "$1" "${2-}"
+      MANIFEST="$2"
+      shift 2
+      ;;
+    --out)
+      require_value "$1" "${2-}"
+      OUT="$2"
+      shift 2
+      ;;
+    --opt)
+      require_value "$1" "${2-}"
+      OPT="$2"
+      shift 2
+      ;;
+    --crate)
+      require_value "$1" "${2-}"
+      CRATE="$2"
+      shift 2
+      ;;
+    --bin)
+      require_value "$1" "${2-}"
+      BIN_TARGET="$2"
+      shift 2
+      ;;
+    --lib)
+      LIB_TARGET=true
+      shift
+      ;;
+    --target)
+      require_value "$1" "${2-}"
+      TARGET_TRIPLE="$2"
+      shift 2
+      ;;
+    --intel-syntax)
+      INTEL_SYNTAX=true
+      shift
+      ;;
+    --help | -h)
+      usage
+      exit 0
+      ;;
+    --)
+      shift
+      EXTRA_ARGS=("$@")
+      break
+      ;;
+    *)
+      die_arg "unknown argument: $1"
+      ;;
+  esac
+done
+
+[[ -n "$MANIFEST" ]] || die_arg "--manifest is required"
+[[ -n "$OUT" ]] || die_arg "--out is required"
+[[ -f "$MANIFEST" ]] || die_run "manifest not found: $MANIFEST"
+[[ -n "$BIN_TARGET" && "$LIB_TARGET" == true ]] && die_arg "--bin and --lib are mutually exclusive"
+
+case "$OPT" in
+  O0) LEVEL="0" ;;
+  O1) LEVEL="1" ;;
+  O2) LEVEL="2" ;;
+  O3) LEVEL="3" ;;
+  *) die_arg "unsupported opt level: $OPT (use O0, O1, O2, O3)" ;;
+esac
+
+OUT_IS_FILE=false
+if [[ "$OUT" == *.s || "$OUT" == *.asm ]]; then
+  OUT_IS_FILE=true
+  mkdir -p "$(dirname "$OUT")"
+else
+  mkdir -p "$OUT"
+fi
+
+CARGO_ARGS=(+nightly rustc --manifest-path "$MANIFEST")
+[[ -n "$CRATE" ]] && CARGO_ARGS+=("-p" "$CRATE")
+[[ -n "$BIN_TARGET" ]] && CARGO_ARGS+=("--bin" "$BIN_TARGET")
+[[ "$LIB_TARGET" == true ]] && CARGO_ARGS+=("--lib")
+[[ -n "$TARGET_TRIPLE" ]] && CARGO_ARGS+=("--target" "$TARGET_TRIPLE")
+
+RUSTC_FLAGS=(--emit=asm -C "opt-level=$LEVEL")
+[[ "$INTEL_SYNTAX" == true ]] && RUSTC_FLAGS+=(-C "llvm-args=-x86-asm-syntax=intel")
+
+TARGET_DIR="${TMPDIR:-/tmp}/zeroize_rust_asm_${LEVEL}_$$"
+rm -rf "$TARGET_DIR"
+mkdir -p "$TARGET_DIR"
+
+echo "=== emit_rust_asm.sh ==="
+echo "manifest: $MANIFEST"
+echo "opt:      $OPT"
+echo "target:   $TARGET_DIR"
+echo "output:   $OUT"
+[[ -n "$TARGET_TRIPLE" ]] && echo "triple:   $TARGET_TRIPLE"
+[[ "$INTEL_SYNTAX" == true ]] && echo "syntax:   intel"
+
+if ! CARGO_TARGET_DIR="$TARGET_DIR" cargo "${CARGO_ARGS[@]}" \
+  "${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}" \
+  -- "${RUSTC_FLAGS[@]}"; then
+  die_run "cargo rustc failed for opt=${OPT}"
+fi
+
+declare -a ASM_FILES=()
+while IFS= read -r file; do
+  ASM_FILES+=("$file")
+done < <(find "$TARGET_DIR" -type f -name "*.s" | LC_ALL=C sort)
+
+[[ "${#ASM_FILES[@]}" -gt 0 ]] || die_run "no .s files found under $TARGET_DIR"
+
+if [[ "$OUT_IS_FILE" == true ]]; then
+  : >"$OUT"
+  for file in "${ASM_FILES[@]}"; do
+    cat "$file" >>"$OUT"
+  done
+  [[ -s "$OUT" ]] || die_run "emitted assembly is empty: $OUT"
+else
+  cp "${ASM_FILES[@]}" "$OUT/"
+fi

package/skills/zeroize-audit/tools/emit_rust_ir.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# emit_rust_ir.sh — Emit Rust LLVM IR for zeroize analysis.
+#
+# Exit codes:
+#   0  success
+#   1  build/output failure
+#   2  argument error
+
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  emit_rust_ir.sh --manifest <Cargo.toml> --out <path> [options] [-- <extra cargo rustc args>]
+
+Options:
+  --manifest <file>        Cargo manifest path (required)
+  --out <path>             Output .ll file (required)
+  --opt <O0|O1|O2|O3>      Opt level (default: O2)
+  --crate <pkg>            Workspace package (-p)
+  --bin <target>           Build only a specific bin target
+  --lib                    Build only the lib target
+  --help                   Show this help text
+
+Examples:
+  emit_rust_ir.sh --manifest Cargo.toml --opt O0 --out /tmp/crate.O0.ll
+  emit_rust_ir.sh --manifest Cargo.toml --opt O2 --bin cli --out /tmp/cli.O2.ll
+EOF
+}
+
+die_arg() {
+  echo "emit_rust_ir.sh: $*" >&2
+  exit 2
+}
+
+die_run() {
+  echo "emit_rust_ir.sh: $*" >&2
+  exit 1
+}
+
+require_value() {
+  local opt="$1"
+  local val="${2-}"
+  [[ -n "$val" ]] || die_arg "missing value for ${opt}"
+}
+
+MANIFEST=""
+OUT=""
+OPT="O2"
+CRATE=""
+BIN_TARGET=""
+LIB_TARGET=false
+EXTRA_ARGS=()
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --manifest)
+      require_value "$1" "${2-}"
+      MANIFEST="$2"
+      shift 2
+      ;;
+    --out)
+      require_value "$1" "${2-}"
+      OUT="$2"
+      shift 2
+      ;;
+    --opt)
+      require_value "$1" "${2-}"
+      OPT="$2"
+      shift 2
+      ;;
+    --crate)
+      require_value "$1" "${2-}"
+      CRATE="$2"
+      shift 2
+      ;;
+    --bin)
+      require_value "$1" "${2-}"
+      BIN_TARGET="$2"
+      shift 2
+      ;;
+    --lib)
+      LIB_TARGET=true
+      shift
+      ;;
+    --help | -h)
+      usage
+      exit 0
+      ;;
+    --)
+      shift
+      EXTRA_ARGS=("$@")
+      break
+      ;;
+    *)
+      die_arg "unknown argument: $1"
+      ;;
+  esac
+done
+
+[[ -n "$MANIFEST" ]] || die_arg "--manifest is required"
+[[ -n "$OUT" ]] || die_arg "--out is required"
+[[ -f "$MANIFEST" ]] || die_run "manifest not found: $MANIFEST"
+[[ -n "$BIN_TARGET" && "$LIB_TARGET" == true ]] && die_arg "--bin and --lib are mutually exclusive"
+[[ "$OUT" == *.ll ]] || die_arg "--out must be a .ll file path"
+
+case "$OPT" in
+  O0) LEVEL="0" ;;
+  O1) LEVEL="1" ;;
+  O2) LEVEL="2" ;;
+  O3) LEVEL="3" ;;
+  *) die_arg "unsupported opt level: $OPT (use O0, O1, O2, O3)" ;;
+esac
+
+mkdir -p "$(dirname "$OUT")"
+
+CARGO_ARGS=(+nightly rustc --manifest-path "$MANIFEST")
+[[ -n "$CRATE" ]] && CARGO_ARGS+=("-p" "$CRATE")
+[[ -n "$BIN_TARGET" ]] && CARGO_ARGS+=("--bin" "$BIN_TARGET")
+[[ "$LIB_TARGET" == true ]] && CARGO_ARGS+=("--lib")
+
+TARGET_DIR="${TMPDIR:-/tmp}/zeroize_rust_ir_${LEVEL}_$$"
+rm -rf "$TARGET_DIR"
+mkdir -p "$TARGET_DIR"
+
+echo "=== emit_rust_ir.sh ==="
+echo "manifest: $MANIFEST"
+echo "opt:      $OPT"
+echo "target:   $TARGET_DIR"
+echo "output:   $OUT"
+
+if ! CARGO_TARGET_DIR="$TARGET_DIR" cargo "${CARGO_ARGS[@]}" \
+  ${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"} \
+  -- --emit=llvm-ir -C opt-level="$LEVEL"; then
+  die_run "cargo rustc failed for opt=${OPT}"
+fi
+
+declare -a LL_FILES=()
+while IFS= read -r file; do
+  LL_FILES+=("$file")
+done < <(find "$TARGET_DIR" -type f -name "*.ll" | LC_ALL=C sort)
+
+[[ "${#LL_FILES[@]}" -gt 0 ]] || die_run "no .ll files found under $TARGET_DIR"
+
+: >"$OUT"
+for file in "${LL_FILES[@]}"; do
+  cat "$file" >>"$OUT"
+done
+
+[[ -s "$OUT" ]] || die_run "emitted IR is empty: $OUT"