Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.
2026-10-27 00:16:42 +01:00
1 parent 1f4d62ae95
commit a491bbd3f8
@@ -0,0 +1,71 @@
+"""Production consumer helpers with real CNG/Crypt32 and deterministic kernel doubles."""
+
+from pathlib import Path
+import subprocess
+import tempfile
+
+root = Path(__file__).resolve().parents[1]
+public = (root / "include/Domito.h").read_text(encoding="utf-8-sig")
+mincrypt = (root / "include/Domito.MinCrypt.h").read_text(encoding="utf-8-sig")
+structures = mincrypt[
+    mincrypt.index("#include <pshpack8.h>") : mincrypt.index("#include <poppack.h>")
+    + len("#include <poppack.h>")
+]
+validation = public[
+    public.index("#if (NTDDI_VERSION >= NTDDI_WIN10)\n// Native forwards") : public.index(
+        "#define DOMITO_CI_SOURCE_EMBEDDED"
+    )
+]
+helpers = (
+    (root / "include/Domito.Consumer.h")
+    .read_text(encoding="utf-8-sig")
+    .replace('#include "Domito.h"', "")
+)
+algorithm = public[
+    public.index("#if !defined(CALG_SHA1)") : public.index(
+        "/*", public.index("DOMITO_CALG_TO_BCRYPT_ALGORITHM(")
+    )
+]
+common = (root / "src/Domito.cpp").read_text(encoding="utf-8-sig")
+process_start = common.rfind("_Success_", 0, common.index("DomitoGetProcessImageName("))
+process = (
+    common[process_start:]
+    .replace('#pragma code_seg("PAGED")', "")
+    .replace("#pragma code_seg()", "")
+)
+with tempfile.TemporaryDirectory(prefix="domito-consumer-tests-") as temp:
+    build = Path(temp)
+    (build / "consumer-api.inc").write_text(
+        algorithm + "\n" + structures + "\n" + validation + "\n" + helpers
+    )
+    bodies = "\n".join(
+        (root / ("src/" + name))
+        .read_text(encoding="utf-8-sig")
+        .replace('#include "Domito.Internal.h"', "")
+        for name in ["Domito.Certificate.cpp", "Domito.Consumer.cpp"]
+    )
+    (build / "consumer-under-test.inc").write_text(bodies + "\n" + process)
+    for branch in ["x64", "other"]:
+        exe = build / (branch + ".exe")
+        flags = ["/DDOMITO_TEST_OTHER_ARCH"] if branch == "other" else []
+        subprocess.run(
+            [
+                "cl",
+                "/nologo",
+                "/EHsc",
+                "/W4",
+                "/WX",
+                "/std:c++17",
+                "/I" + str(build),
+                *flags,
+                str(root / "tests/consumer-helper-tests.cpp"),
+                "/Fe" + str(exe),
+                "/Fo" + str(build / (branch + ".obj")),
+                "/link",
+                "bcrypt.lib",
+                "crypt32.lib",
+            ],
+            cwd=build,
+            check=True,
+        )
+        subprocess.run([str(exe)], check=True)