security

🤖 AI-Generated Content

This documentation was generated with AI assistance and is still being audited. Some, or potentially a lot, of this information may be inaccurate. Learn more.

flavor.psp.security

PSP Security - Integrity verification and cryptographic operations.

This module provides security-related functionality for PSP packages, including integrity verification, signature validation, and tamper detection.

Classes

PSPFIntegrityVerifier

PSPFIntegrityVerifier()

PSPF package integrity verifier implementation.

Provides comprehensive verification including signatures, checksums, and tamper detection using the Protocol pattern.

Initialize the verifier.

Source code in flavor/psp/security.py

def __init__(self) -> None:
    """Initialize the verifier."""

Functions

verify_integrity

verify_integrity(bundle_path: Path) -> IntegrityResult

Verify the integrity of a PSPF package bundle.

Parameters:

Name	Type	Description	Default
bundle_path	Path	Path to the package bundle file	required

Returns:

Type	Description
IntegrityResult	IntegrityResult dictionary with verification status

Source code in flavor/psp/security.py

def verify_integrity(self, bundle_path: Path) -> IntegrityResult:
    """
    Verify the integrity of a PSPF package bundle.

    Args:
        bundle_path: Path to the package bundle file

    Returns:
        IntegrityResult dictionary with verification status
    """
    logger.debug(f"🔐 Verifying package integrity: {bundle_path}")
    validation_level = get_validation_level()

    if validation_level == ValidationLevel.NONE:
        logger.warning("⚠️ VALIDATION DISABLED: Skipping integrity verification")
        return {"valid": True, "signature_valid": True, "tamper_detected": False}

    try:
        with PSPFReader(bundle_path) as reader:
            index = reader.read_index()
            metadata = reader.read_metadata()

            signature_valid = True
            tamper_detected = False

            # Signature verification
            if validation_level in (ValidationLevel.RELAXED, ValidationLevel.MINIMAL):
                logger.debug("🔐 Skipping signature verification due to validation level")
            else:
                signature_valid, tamper_detected = self._verify_signature(reader, index, validation_level)

            # Slot verification
            if validation_level != ValidationLevel.MINIMAL:
                slot_sig_valid, slot_tamper = self._verify_all_slots(reader, validation_level)
                if not slot_sig_valid:
                    signature_valid = False
                if slot_tamper:
                    tamper_detected = True
            else:
                logger.debug("🔐 Skipping slot verification due to minimal validation level")

            valid = self._determine_validity(validation_level, metadata, signature_valid, tamper_detected)

            result: IntegrityResult = {
                "valid": valid,
                "signature_valid": signature_valid,
                "tamper_detected": tamper_detected,
            }
            logger.debug(f"🔐 Integrity verification complete: {result} (level: {validation_level.name})")
            return result

    except Exception as e:
        if validation_level == ValidationLevel.STRICT:
            logger.error(f"❌ Integrity verification failed: {e}")
            return {"valid": False, "signature_valid": False, "tamper_detected": True}
        logger.warning(f"⚠️ Integrity verification error: {e}")
        logger.warning("⚠️ Continuing due to validation level")
        return {"valid": True, "signature_valid": False, "tamper_detected": False}

ValidationLevel

Bases: IntEnum

Validation levels matching Go/Rust implementations.

Functions

get_validation_level

get_validation_level() -> ValidationLevel

Get validation level from Foundation config, matching Go/Rust behavior.

Returns:

Name	Type	Description
ValidationLevel	ValidationLevel	The current validation level

Source code in flavor/psp/security.py

def get_validation_level() -> ValidationLevel:
    """
    Get validation level from Foundation config, matching Go/Rust behavior.

    Returns:
        ValidationLevel: The current validation level
    """
    # Get validation level from Foundation config system
    config = get_flavor_config()
    val = config.system.security.validation_level.lower()

    if val == VALIDATION_STRICT:
        return ValidationLevel.STRICT
    elif val == VALIDATION_RELAXED:
        return ValidationLevel.RELAXED
    elif val == VALIDATION_MINIMAL:
        return ValidationLevel.MINIMAL
    elif val == VALIDATION_NONE:
        logger.warning("⚠️ SECURITY WARNING: Validation disabled (FLAVOR_VALIDATION=none)")
        logger.warning("⚠️ This is NOT RECOMMENDED for production use")
        return ValidationLevel.NONE
    else:  # VALIDATION_STANDARD or unknown
        return ValidationLevel.STANDARD

verify_package_integrity

verify_package_integrity(
    bundle_path: Path,
) -> IntegrityResult

Convenience function to verify package integrity.

Parameters:

Name	Type	Description	Default
bundle_path	Path	Path to the package bundle file	required

Returns:

Type	Description
IntegrityResult	IntegrityResult dictionary with verification status

Source code in flavor/psp/security.py

def verify_package_integrity(bundle_path: Path) -> IntegrityResult:
    """
    Convenience function to verify package integrity.

    Args:
        bundle_path: Path to the package bundle file

    Returns:
        IntegrityResult dictionary with verification status
    """
    return _verifier.verify_integrity(bundle_path)