mirror of
https://github.com/azaion/gps-denied-onboard.git
synced 2026-06-21 10:11:12 +00:00
Oleksandr Bezdieniezhnykh
33486588de
E-CC-HELPERS closes with the three remaining Layer-1 helpers and E-CC-CONF closes with the env > YAML > defaults precedence test gate. All four tickets ship with frozen public surfaces, hermetic unit tests, and no upward (components.*) imports. * AZ-271 — tests/unit/shared/config/test_precedence.py (5 ACs + smoke test + helper that names the layer in failure messages). * AZ-282 — helpers/ransac_filter.py: static RansacFilter + RansacResult; cv2.setRNGSeed(0) for byte-equal determinism; median residual semantics pinned by contract. * AZ-276 — helpers/imu_preintegrator.py + make_imu_preintegrator; GTSAM PreintegratedCombinedMeasurements; strict-monotonic ts_ns guard runs before any state mutation. Adjacent hygiene: _types/nav.py ImuSample/ImuWindow now use ts_ns:int and the spec-mandated ImuBias dataclass. * AZ-278 — helpers/lightglue_runtime.py: structural R14 fix. LightGlueRuntime + non-blocking concurrent-access guard that raises rather than serialising. EngineHandle Protocol in _types/manifests.py + KeypointSet/CorrespondenceSet in _types/matching.py (Protocol surface adds approved by spec). Dependency conflict (Finding 1, user-approved): gtsam 4.2 (PyPI) is numpy-1.x-ABI only; opencv-python>=4.12 needs numpy>=2 at runtime. Resolution: opencv-python pin relaxed to >=4.11.0.86,<4.12. The D-CROSS-CVE-1 ratchet at ci/opencv_pin_gate.py is held at 4.11.0 with the original 4.12.0 floor restored once a numpy-2-compatible gtsam wheel ships. Full replay procedure in _docs/_process_leftovers/2026-05-11_d_cross_cve_1_opencv_pin_deferred.md. Tests: 294 passed, 2 skipped (cmake/actionlint env-skips, pre-existing). 43 new tests added for batch 5. Ruff check + format clean. Co-authored-by: Cursor <cursoragent@cursor.com>
126 lines
3.3 KiB
Python
126 lines
3.3 KiB
Python
"""AC-10: SBOM diff script + OpenCV pin gate exist and run on stub builds."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
CI_DIR = REPO_ROOT / "ci"
|
|
|
|
|
|
def test_sbom_diff_pass_on_subset(tmp_path: Path) -> None:
|
|
# Arrange
|
|
research = tmp_path / "research_sbom.json"
|
|
deployment = tmp_path / "deployment_sbom.json"
|
|
research.write_text(
|
|
json.dumps(
|
|
[
|
|
{"name": "numpy", "version": "1.26.4"},
|
|
{"name": "scipy", "version": "1.11.3"},
|
|
{"name": "okvis2", "version": "0.1.0"},
|
|
]
|
|
)
|
|
)
|
|
deployment.write_text(
|
|
json.dumps(
|
|
[
|
|
{"name": "numpy", "version": "1.26.4"},
|
|
{"name": "okvis2", "version": "0.1.0"},
|
|
]
|
|
)
|
|
)
|
|
|
|
# Act
|
|
result = subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(CI_DIR / "sbom_diff.py"),
|
|
"--deployment",
|
|
str(deployment),
|
|
"--research",
|
|
str(research),
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
|
|
# Assert
|
|
assert result.returncode == 0, f"sbom_diff stderr:\n{result.stderr}"
|
|
|
|
|
|
def test_sbom_diff_fails_on_forbidden_component(tmp_path: Path) -> None:
|
|
# Arrange — ADR-002 / R02: vins_mono must not appear in deployment SBOM
|
|
research = tmp_path / "research_sbom.json"
|
|
deployment = tmp_path / "deployment_sbom.json"
|
|
research.write_text(json.dumps([{"name": "vins_mono", "version": "0.1"}]))
|
|
deployment.write_text(json.dumps([{"name": "vins_mono", "version": "0.1"}]))
|
|
|
|
# Act
|
|
result = subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(CI_DIR / "sbom_diff.py"),
|
|
"--deployment",
|
|
str(deployment),
|
|
"--research",
|
|
str(research),
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
|
|
# Assert
|
|
assert result.returncode != 0, (
|
|
"sbom_diff must fail when a research-only component appears in deployment"
|
|
)
|
|
|
|
|
|
def test_opencv_pin_gate_passes_on_412_minimum() -> None:
|
|
# Act
|
|
result = subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(CI_DIR / "opencv_pin_gate.py"),
|
|
"--pyproject",
|
|
str(REPO_ROOT / "pyproject.toml"),
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
|
|
# Assert
|
|
assert result.returncode == 0, f"opencv_pin_gate stderr:\n{result.stderr}"
|
|
|
|
|
|
def test_opencv_pin_gate_fails_on_lower_version(tmp_path: Path) -> None:
|
|
# Arrange — 4.10 is below the (relaxed) 4.11 floor; the gate still rejects.
|
|
bad_pyproject = tmp_path / "pyproject.toml"
|
|
bad_pyproject.write_text(
|
|
'[project]\nname = "x"\nversion = "0.1"\ndependencies = ["opencv-python>=4.10,<5"]\n'
|
|
)
|
|
|
|
# Act
|
|
result = subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(CI_DIR / "opencv_pin_gate.py"),
|
|
"--pyproject",
|
|
str(bad_pyproject),
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
|
|
# Assert
|
|
assert result.returncode != 0, (
|
|
"opencv_pin_gate must reject `opencv-python>=4.10` "
|
|
"(D-CROSS-CVE-1 floor relaxed to 4.11.0; see _docs/_process_leftovers/)"
|
|
)
|