pytest-gpu-proof 0.1.0__py3-none-any.whl

pytest_gpu_proof/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

pytest_gpu_proof/__main__.py

@@ -0,0 +1,3 @@
+from pytest_gpu_proof.cli import main
+
+main()

pytest_gpu_proof/cli.py

@@ -0,0 +1,95 @@
+import argparse
+import sys
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="gpu-proof",
+        description="pytest-gpu-proof: verify signed GPU test receipts",
+    )
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    # verify
+    vp = subparsers.add_parser(
+        "verify",
+        help="Verify a signed receipt against GitHub public keys",
+    )
+    vp.add_argument("--receipt", required=True, metavar="PATH", help="Path to gpu-proof.json")
+    vp.add_argument(
+        "--policy",
+        default=None,
+        metavar="PATH",
+        help="Path to policy YAML/JSON (optional)",
+    )
+    vp.add_argument(
+        "--repo",
+        default=".",
+        metavar="PATH",
+        help="Repository root for fingerprint recomputation (default: .)",
+    )
+    vp.add_argument(
+        "--github-user",
+        default=None,
+        metavar="USERNAME",
+        help="Override GitHub username (default: read from receipt)",
+    )
+    vp.add_argument(
+        "--max-age-days",
+        type=int,
+        default=None,
+        metavar="N",
+        help="Override max receipt age in days",
+    )
+    vp.add_argument(
+        "--allow-unsigned",
+        action="store_true",
+        default=False,
+        help="Accept UNSIGNED receipts (signature: null). Unsigned receipts prove "
+        "nothing about who ran the tests — use only if you accept that.",
+    )
+    vp.add_argument(
+        "--allow-skipped",
+        action="store_true",
+        default=False,
+        help="Accept receipts that contain skipped marked tests (default: reject)",
+    )
+    vp.add_argument(
+        "--expected-skips",
+        default=None,
+        metavar="PATH",
+        help="Baseline file of node IDs (one per line, '#' comments) that the "
+        "receipt's skipped tests must match EXACTLY — new skips fail, and a "
+        "baselined test that now runs flags the baseline as stale. Stricter "
+        "than (and mutually exclusive with) --allow-skipped. Can also be set "
+        "as an inline list via expected_skips in [tool.gpu_proof].",
+    )
+    vp.add_argument(
+        "--require-gpu",
+        action="store_true",
+        default=None,
+        help="Fail verification if the receipt's environment.gpu_info is null/absent "
+        "(modest hardening, not proof of GPU execution). Can also be set via "
+        "require_gpu = true in [tool.gpu_proof].",
+    )
+
+    args = parser.parse_args()
+
+    if args.command == "verify":
+        from .verify import verify_receipt
+
+        ok = verify_receipt(
+            receipt_path=args.receipt,
+            policy_path=args.policy,
+            repo_root=args.repo,
+            github_user_override=args.github_user,
+            max_age_days=args.max_age_days,
+            allow_unsigned=args.allow_unsigned,
+            allow_skipped=args.allow_skipped,
+            require_gpu=args.require_gpu,
+            expected_skips_path=args.expected_skips,
+        )
+        sys.exit(0 if ok else 1)
+
+
+if __name__ == "__main__":
+    main()

pytest_gpu_proof/compare.py

@@ -0,0 +1,49 @@
+from typing import Any, Callable, Optional, Tuple
+
+
+def default_compare(ref: Any, cand: Any) -> None:
+    """numpy.allclose for float arrays, exact equality otherwise. Raises AssertionError on mismatch."""
+    try:
+        import numpy as np
+
+        ref_arr = np.asarray(ref)
+        cand_arr = np.asarray(cand)
+        if ref_arr.dtype.kind in ("f", "c"):
+            if not np.allclose(ref_arr, cand_arr):
+                max_diff = float(np.max(np.abs(ref_arr - cand_arr)))
+                raise AssertionError(f"Arrays not close: max difference = {max_diff:.6e}")
+            return
+    except (ImportError, TypeError, ValueError):
+        pass
+
+    if ref != cand:
+        raise AssertionError(f"Values not equal: {ref!r} != {cand!r}")
+
+
+def run_comparison(
+    reference: Callable,
+    candidate: Callable,
+    args: tuple,
+    kwargs: dict,
+    compare_fn: Optional[Callable] = None,
+) -> Tuple[str, Any, Any, Optional[str]]:
+    """
+    Call reference and candidate with the same args, then compare outputs.
+    Returns (outcome, ref_result, cand_result, error_message).
+    """
+    try:
+        ref_result = reference(*args, **kwargs)
+    except Exception as e:
+        return "error", None, None, f"Reference raised: {e}"
+
+    try:
+        cand_result = candidate(*args, **kwargs)
+    except Exception as e:
+        return "error", ref_result, None, f"Candidate raised: {e}"
+
+    compare = compare_fn if compare_fn is not None else default_compare
+    try:
+        compare(ref_result, cand_result)
+        return "passed", ref_result, cand_result, None
+    except AssertionError as e:
+        return "failed", ref_result, cand_result, str(e)

pytest_gpu_proof/config.py

@@ -0,0 +1,82 @@
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Union
+
+
+@dataclass
+class GpuProofConfig:
+    enabled: bool = False
+    mode: str = "local"
+    output: str = "gpu-proof.json"
+    key_path: Optional[str] = None
+    signing_backend: str = "ed25519"
+    policy_path: Optional[str] = None
+    required_marker: str = "gpu_proof"
+    fail_on_skip: bool = False
+    fingerprint_paths: List[str] = field(default_factory=lambda: ["src", "tests"])
+    github_username: Optional[str] = None
+    max_age_days: int = 30
+    require_gpu: bool = False
+
+
+def load_toml_defaults(root: Union[str, Path]) -> Dict[str, Any]:
+    """Read the ``[tool.gpu_proof]`` table from ``<root>/pyproject.toml``.
+
+    Returns an empty dict when the file or table is absent or unparseable.
+    """
+    pyproject = Path(root) / "pyproject.toml"
+    if not pyproject.is_file():
+        return {}
+    try:
+        with open(pyproject, "rb") as f:
+            data = tomllib.load(f)
+    except (tomllib.TOMLDecodeError, OSError):
+        return {}
+    table = data.get("tool", {}).get("gpu_proof", {})
+    return table if isinstance(table, dict) else {}
+
+
+def load_config(pytest_config) -> GpuProofConfig:
+    toml_cfg = load_toml_defaults(pytest_config.rootpath)
+
+    def opt(name, default=None):
+        try:
+            return pytest_config.getoption(name)
+        except ValueError:
+            return default
+
+    def resolve(opt_name, toml_key, default):
+        """Precedence: CLI flag (when it differs from its built-in default),
+        then [tool.gpu_proof] in pyproject.toml, then the built-in default."""
+        cli = opt(opt_name, default)
+        if cli != default:
+            return cli
+        toml_val = toml_cfg.get(toml_key)
+        if toml_val is not None:
+            return toml_val
+        return default
+
+    raw_paths = resolve("--gpu-proof-fingerprint-paths", "fingerprint_paths", "src,tests")
+    if isinstance(raw_paths, str):
+        paths = [p.strip() for p in raw_paths.split(",") if p.strip()]
+    else:
+        paths = [str(p) for p in raw_paths]
+
+    max_age = toml_cfg.get("max_age_days")
+    max_age_days = int(max_age) if max_age is not None else 30
+
+    return GpuProofConfig(
+        enabled=bool(opt("--gpu-proof-enable", False)),
+        mode=resolve("--gpu-proof-mode", "mode", "local"),
+        output=resolve("--gpu-proof-out", "output", "gpu-proof.json"),
+        key_path=resolve("--gpu-proof-key", "key_path", None),
+        signing_backend=resolve("--gpu-proof-signing-backend", "signing_backend", "ed25519"),
+        policy_path=resolve("--gpu-proof-policy", "policy_path", None),
+        required_marker=resolve("--gpu-proof-required-marker", "required_marker", "gpu_proof"),
+        fail_on_skip=bool(resolve("--gpu-proof-fail-on-skip", "fail_on_skip", False)),
+        fingerprint_paths=paths,
+        github_username=resolve("--gpu-proof-github-user", "github_username", None),
+        max_age_days=max_age_days,
+        require_gpu=bool(toml_cfg.get("require_gpu", False)),
+    )

pytest_gpu_proof/fingerprint.py

@@ -0,0 +1,38 @@
+import hashlib
+import json
+import os
+from typing import List
+
+from .gitutils import get_tracked_files
+
+
+def _hash_file(path: str, root: str) -> str:
+    h = hashlib.sha256()
+    with open(os.path.join(root, path), "rb") as f:
+        for chunk in iter(lambda: f.read(65536), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def compute_fingerprint(paths: List[str], root: str = ".") -> dict:
+    tracked = get_tracked_files(paths, root)
+    file_hashes = {}
+    for p in tracked:
+        try:
+            file_hashes[p] = _hash_file(p, root)
+        except OSError:
+            pass
+
+    canonical = json.dumps(
+        {"files": {k: file_hashes[k] for k in sorted(file_hashes)}},
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+    digest = hashlib.sha256(canonical.encode()).hexdigest()
+
+    return {
+        "algorithm": "sha256",
+        "included_paths": sorted(paths),
+        "file_count": len(file_hashes),
+        "digest": digest,
+    }

pytest_gpu_proof/gitutils.py

@@ -0,0 +1,112 @@
+import re
+import subprocess
+from typing import Optional
+
+
+def _git(*args) -> Optional[str]:
+    try:
+        result = subprocess.run(
+            ["git"] + list(args),
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return result.stdout.strip() or None
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        return None
+
+
+def get_commit_sha() -> Optional[str]:
+    return _git("rev-parse", "HEAD")
+
+
+def get_branch() -> Optional[str]:
+    return _git("rev-parse", "--abbrev-ref", "HEAD")
+
+
+def is_dirty() -> bool:
+    # --ignore-submodules=untracked: untracked files INSIDE a submodule (build
+    # deps, caches) cannot change the code a receipt attests — the submodule's
+    # content is pinned by the parent's gitlink, and a *pin* change (a different
+    # or new commit checked out in the submodule) still reports as modified
+    # under this flag. Without it, a consumer whose submodule carries build
+    # artifacts can never produce a clean receipt (first hit: GATO's sqpcpu
+    # baseline submodule).
+    try:
+        result = subprocess.run(
+            ["git", "status", "--porcelain", "--ignore-submodules=untracked"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return bool(result.stdout.strip())
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        return False
+
+
+def get_remote_url() -> Optional[str]:
+    return _git("remote", "get-url", "origin")
+
+
+def extract_github_username(remote_url: str) -> Optional[str]:
+    match = re.search(r"github\.com[:/]([^/]+)/", remote_url)
+    return match.group(1) if match else None
+
+
+def get_github_username() -> Optional[str]:
+    url = get_remote_url()
+    return extract_github_username(url) if url else None
+
+
+def get_gh_cli_login() -> Optional[str]:
+    """The authenticated GitHub CLI user, if `gh` is installed and logged in.
+
+    This is the KEYHOLDER — the account whose github.com/<user>.keys will
+    verify the receipt — unlike the origin-remote owner, which for org-owned
+    repos is an org with no SSH keys.
+    """
+    try:
+        result = subprocess.run(
+            ["gh", "api", "user", "--jq", ".login"],
+            capture_output=True,
+            text=True,
+            check=True,
+            timeout=10,
+        )
+        return result.stdout.strip() or None
+    except (subprocess.CalledProcessError, FileNotFoundError,
+            subprocess.TimeoutExpired):
+        return None
+
+
+def get_git_signing_key() -> Optional[str]:
+    val = _git("config", "--get", "user.signingKey")
+    if not val:
+        return None
+    import os
+    return os.path.expanduser(val)
+
+
+def get_tracked_files(paths, root="."):
+    try:
+        result = subprocess.run(
+            ["git", "ls-files"] + list(paths),
+            capture_output=True,
+            text=True,
+            check=True,
+            cwd=root,
+        )
+        return sorted(line for line in result.stdout.splitlines() if line)
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        import os
+        files = []
+        for path in paths:
+            full = os.path.join(root, path)
+            if os.path.isfile(full):
+                files.append(os.path.relpath(full, root))
+            elif os.path.isdir(full):
+                for dirpath, _, filenames in os.walk(full):
+                    for fn in filenames:
+                        fp = os.path.join(dirpath, fn)
+                        files.append(os.path.relpath(fp, root))
+        return sorted(files)