Merge FEATURE-ci-freebsd-readelf-format: Parse native FreeBSD dependencies

Author: etr

scripts/audit-v3-installed-package.py

@@ -200,7 +200,10 @@ def platform_inspector(path):
         dynamic = run(['readelf', '-d', path])
         if 'Dynamic section' not in dynamic:
             raise AuditError('missing ELF dynamic section: ' + path)
-        names = re.findall(r'\(NEEDED\).*\[(.*?)\]', dynamic)
+        # FreeBSD readelf uses bare tags; GNU readelf parenthesizes them.
+        names = re.findall(
+            r'^[ \t]*(?:0x[0-9a-fA-F]+[ \t]+(?:NEEDED|\(NEEDED\))|\(NEEDED\))'
+            r'[ \t]+Shared library:[ \t]+\[([^\]\s]+)\][ \t]*$', dynamic, re.M)
         if not names:
             if runtime(path):
                 return []

scripts/test-v3-installed-package.py

@@ -643,6 +643,110 @@ def test_current_umbrella_has_no_backend_types(self):
         self.assertEqual([], audit.header_violations(result, []))
 
 
+# Exact /usr/bin/readelf -d stdout from FreeBSD package job 120773457461,
+# run 40060736308, artifact 12550179871; SHA256 1f60a5922ad44f8a14c69bed7b378558f0f3c02056597781045b37e9610a4a45.
+FREEBSD_NATIVE_DYNAMIC = (
+    '\n'
+    'Dynamic section at offset 0x27530 contains 30 entries:\n'
+    '  Tag                Type                  Name/Value\n'
+    ' 0x000000000000001d RUNPATH              Library runpath: [/tmp/v3-package-40060736308-1/package-evidence/matrix/tls-no/prefix/lib:/tmp/v3-package-40060736308-1/package-evidence/prerequisites/provider/lib:/tmp/v3-package-40060736308-1/package-evidence/toolchain/lib]\n'
+    ' 0x0000000000000001 NEEDED               Shared library: [libhttpserver.so.3]\n'
+    ' 0x0000000000000001 NEEDED               Shared library: [libc++.so.1]\n'
+    ' 0x0000000000000001 NEEDED               Shared library: [libcxxrt.so.1]\n'
+    ' 0x0000000000000001 NEEDED               Shared library: [libm.so.5]\n'
+    ' 0x0000000000000001 NEEDED               Shared library: [libgcc_s.so.1]\n'
+    ' 0x0000000000000001 NEEDED               Shared library: [libthr.so.3]\n'
+    ' 0x0000000000000001 NEEDED               Shared library: [libc.so.7]\n'
+    ' 0x0000000000000015 DEBUG                0x0\n'
+    ' 0x0000000000000007 RELA                 0x205d40\n'
+    ' 0x0000000000000008 RELASZ               432 (bytes)\n'
+    ' 0x0000000000000009 RELAENT              24 (bytes)\n'
+    ' 0x0000000000000017 JMPREL               0x205ef0\n'
+    ' 0x0000000000000002 PLTRELSZ             2040 (bytes)\n'
+    ' 0x0000000000000003 PLTGOT               0x22a970\n'
+    ' 0x0000000000000014 PLTREL               RELA\n'
+    ' 0x0000000000000006 SYMTAB               0x200308\n'
+    ' 0x000000000000000b SYMENT               24 (bytes)\n'
+    ' 0x0000000000000005 STRTAB               0x2021b8\n'
+    ' 0x000000000000000a STRSZ                15233 (bytes)\n'
+    ' 0x000000006ffffef5 GNU_HASH             0x201808\n'
+    ' 0x0000000000000004 HASH                 0x201b70\n'
+    ' 0x0000000000000019 INIT_ARRAY          \n'
+    ' 0x000000000000001b INIT_ARRAYSZ         8 (bytes)\n'
+    ' 0x000000000000000c INIT                 0x227f80\n'
+    ' 0x000000000000000d FINI                 0x227f8c\n'
+    ' 0x000000006ffffff0 VERSYM               0x2015c8\n'
+    ' 0x000000006ffffffe VERNEED              0x201758\n'
+    ' 0x000000006fffffff VERNEEDNUM           4\n'
+    ' 0x0000000000000000 NULL                 0x0\n'
+)
+
+
+class ElfInspectorTest(unittest.TestCase):
+    def inspect(self, dynamic, resolved='', host='FreeBSD'):
+        def command(argv, **kwargs):
+            output = {'readelf': dynamic, 'ldd': resolved}[argv[0]]
+            return subprocess.CompletedProcess(argv, 0, output, '')
+        audit.COMMANDS.clear()
+        with patch.object(audit.platform, 'system', return_value=host), \
+                patch.object(subprocess, 'run', side_effect=command):
+            return audit.platform_inspector('/package/consumer')
+
+    def test_captured_freebsd_needed_rows_resolve_all_seven_dependencies(self):
+        names = ['libhttpserver.so.3', 'libc++.so.1', 'libcxxrt.so.1', 'libm.so.5',
+                 'libgcc_s.so.1', 'libthr.so.3', 'libc.so.7']
+        resolved = ''.join(f' {name} => /selected/lib/{name} (0x1)\n' for name in names)
+
+        dependencies = self.inspect(FREEBSD_NATIVE_DYNAMIC, resolved)
+
+        self.assertEqual([(name, '/selected/lib/' + name) for name in names], dependencies)
+        self.assertEqual(FREEBSD_NATIVE_DYNAMIC, audit.COMMANDS[0]['stdout'])
+        self.assertEqual(0, audit.COMMANDS[0]['returncode'])
+        self.assertEqual('', audit.COMMANDS[0]['stderr'])
+
+    def test_elf_inspection_requires_dynamic_section_and_nonempty_dependencies(self):
+        for host in ('FreeBSD', 'Linux'):
+            for dynamic, error in (
+                    ('0x1 NEEDED Shared library: [libc.so.7]\n', 'missing ELF dynamic section'),
+                    ('Dynamic section at offset 0 contains 1 entry:\n 0x0 NULL 0x0\n',
+                     'empty ELF dependency inspection')):
+                with self.subTest(host=host, dynamic=dynamic), self.assertRaisesRegex(audit.AuditError, error):
+                    self.inspect(dynamic, host=host)
+
+    def test_needed_dependencies_require_successful_ldd_resolution(self):
+        for host in ('FreeBSD', 'Linux'):
+            for resolved, error in (
+                    ('libc++.so.1 => not found\n', 'unresolved ELF dependency'),
+                    ('libhttpserver.so.3 => /package/lib/libhttpserver.so.3 (0x1)\n',
+                     r'missing resolution for libc\+\+\.so\.1')):
+                with self.subTest(host=host, resolved=resolved), self.assertRaisesRegex(audit.AuditError, error):
+                    self.inspect(FREEBSD_NATIVE_DYNAMIC, resolved, host)
+
+    def test_malformed_tags_and_non_needed_noise_cannot_supply_dependencies(self):
+        for row in (
+                '0x1 NOTNEEDED Shared library: [libnoise.so]',
+                '0x1 NEEDED_EXTRA Shared library: [libnoise.so]',
+                '0x1 (NEEDED Shared library: [libnoise.so]',
+                '0x1 NEEDED) Shared library: [libnoise.so]',
+                'diagnostic (NEEDED) Shared library: [libnoise.so]',
+                '0x1 RUNPATH Shared library: [libnoise.so]',
+                '0x1 NEEDED Library runpath: [libnoise.so]',
+                '0x1 NEEDED Shared library: []',
+                '0x1 NEEDED Shared library: [libnoise.so',
+                '0x1 (NEEDED) Shared library: [libnoise.so] trailing noise'):
+            with self.subTest(row=row), self.assertRaisesRegex(audit.AuditError, 'empty ELF dependency inspection'):
+                self.inspect('Dynamic section at offset 0 contains 1 entry:\n ' + row + '\n',
+                             'libnoise.so => /selected/lib/libnoise.so (0x1)\n')
+
+    def test_non_needed_rows_do_not_add_edges_to_valid_gnu_inspection(self):
+        dynamic = ('Dynamic section at offset 0 contains 3 entries:\n'
+                   ' 0x1 (NEEDED) Shared library: [libc.so.6]\n'
+                   ' 0x1 NOTNEEDED Shared library: [libnoise.so]\n'
+                   ' diagnostic (NEEDED) Shared library: [libnoise.so]\n')
+        dependencies = self.inspect(dynamic, 'libc.so.6 => /lib/libc.so.6 (0x1)\n', 'Linux')
+        self.assertEqual([('libc.so.6', '/lib/libc.so.6')], dependencies)
+
+
 class AuditFixturePathTest(unittest.TestCase):
     def test_unwind_contract_under_symlinked_temporary_root(self):
         original_tempdir = tempfile.tempdir

specs/tasks/FEATURE-ci-freebsd-readelf-format.md

@@ -0,0 +1,58 @@
+# FEATURE-ci-freebsd-readelf-format
+
+Status: Complete (local validation/finalization; native CI pending).
+Base: local v3 `e56a14f0f6748209ac39c1319bc1c894529ab2a4`.
+Plan: primary `.groundwork-plans/FEATURE-ci-freebsd-readelf-format-plan.md`.
+Journal: primary `.debug/ci-7880-freebsd-readelf-6x0vi2k0/journal.md`.
+
+Accept the captured FreeBSD bare NEEDED dynamic tag column in the installed
+package auditor, preserving GNU parenthesized tags and fail-closed inspection,
+resolution, recursive graph evidence, runtime classification and package policy.
+The native receipt supplies new evidence for this repair; prior closed unknown
+assessments remain closed. Scope is the ELF needed-format parser and its tests.
+
+- [x] Read accepted plan, primary instructions, native stdout and existing owner/tests; isolate from exact local v3.
+- [x] Record meaningful RED through the real inspector with exact native stdout and all seven expected names.
+- [x] Make the minimal parser repair with GNU compatibility and strict malformed/noise controls.
+- [x] Verify affected suite, direct consumer/failure evidence contracts, real local GNU ELF, Python compilation and diff checks.
+- [x] Caller Groundwork validation/finalization.
+- [ ] Native FreeBSD post-fix package/archive checks: CI/v3 PR owned, incomplete; not a local acceptance gate.
+
+No runtime leaves, whitelists, loader/policy relaxation, inspector retries or new
+native format assumptions are authorized. No broad baseline/SDK/native probe,
+CI control, merge, publication or cleanup belongs to this implementation.
+
+Local implementation evidence (2026-10-23):
+
+The native stdout is retained literally in the existing distributed test module,
+with its command/job/artifact origin and SHA256. The real platform inspector and
+command recorder, with only subprocess output controlled, resolve all seven
+expected names to exact paths. The old parser raised `empty ELF dependency
+inspection` on this regression. The replacement recognizes full bare/parenthesized
+NEEDED rows; malformed tags, wrong labels, empty names and surrounding diagnostic
+noise cannot supply dependency entries. Existing GNU fixtures remain unchanged.
+Dynamic-section, nonruntime empty-result, unresolved/missing ldd resolution,
+recursive provenance/hash and runtime/TLS/legacy policy requirements remain.
+
+Verification: all 53 installed-package tests pass (48 existing, five new); all
+four installed-consumer inspection-failure tests and the direct package/archive
+receipt-recovery test pass. A small real local GNU C++ ELF goes through real
+readelf/ldd and recursive graph inspection: six hashed nodes, 11 edges, strict
+TLS-off policy passes. This proves local GNU compatibility, not native FreeBSD
+loader behavior. Python compilation and diff whitespace checks pass; there is
+no documented Python lint command. Original 54 existing helper/test method ASTs
+are unchanged, and the embedded native stdout matches all 1968 captured bytes.
+
+Logs, source hashes, local GNU graph/commands and limits are retained in primary
+`.debug/ci-7880-freebsd-readelf-6x0vi2k0/implementation/`. One mistyped recovery
+test selector failed at discovery; its log is retained separately, the exact
+existing selector was then used and passed. No subsystem failure was observed.
+Caller Groundwork validation passed and local finalization is recorded below. Native FreeBSD
+post-fix package/archive checks remain CI/v3 PR owned and incomplete.
+
+Groundwork validation `ea1324dc403a04447c1cce7f522e9740` sealed PASS for
+`1172ebdcdc41fbec480f6fe3805b75d238b09eb1`: one iteration, nine independent
+approvals, zero fixes and one approved unworked finding persisted by the helper.
+The helper report is retained unread for separately owned work. Native FreeBSD
+post-fix package/archive validation remains incomplete and CI/v3 PR owned.
+Prior failed receipts and closed uncertainty remain preserved.

specs/unworked_review_issues/feature-ci-freebsd-readelf-format_validation_ea1324dc403a04447c1cce7f522e9740.md

@@ -0,0 +1,11 @@
+# Unworked Review Issues
+
+**Run:** 2026-10-23 23:56:07
+**Task:** FEATURE-ci-freebsd-readelf-format
+**Total:** 1 (0 critical, 1 major, 0 minor)
+
+## Major
+
+1. [ ] **security-reviewer** | `scripts/audit-v3-installed-package.py:206` | input-validation
+   The new whitespace-excluding name pattern silently drops a recognized NEEDED entry whenever another entry matches. A bounded real-inspector probe with GNU rows for libc.so.6 and libunexpected name.so returns only libc.so.6, whereas the original parser raises missing resolution for libunexpected name.so. The omitted library is never visited, hashed or checked by graph_violations. This violates the accepted fail-closed recursive graph requirement and can conceal an undeclared runtime dependency (CWE-20).
+   *Recommendation:* Fail closed when a recognized NEEDED row cannot be completely parsed or resolved; unsupported names need not be accepted, but must not disappear from an otherwise successful inspection. Add a mixed valid/unsupported NEEDED regression verifying rejection rather than a partial dependency list.