28 lines
921 B
Python
28 lines
921 B
Python
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
path = Path("SECURITY_REPORT.md")
|
||
|
|
if not path.is_file():
|
||
|
|
raise SystemExit("SECURITY_REPORT.md is required")
|
||
|
|
text = path.read_text(encoding="utf-8").lower()
|
||
|
|
required = ("command", "observation", "rejected", "normalized_asset_path", "traversal")
|
||
|
|
missing = [term for term in required if term not in text]
|
||
|
|
if missing:
|
||
|
|
raise SystemExit("security report lacks evidence fields: " + ", ".join(missing))
|
||
|
|
if "normalized_asset_path" in text and not any(
|
||
|
|
term in text for term in ("not vulnerable", "negative control", "rejected candidate")
|
||
|
|
):
|
||
|
|
raise SystemExit("benign normalizer was not explicitly rejected as a finding")
|
||
|
|
print(
|
||
|
|
json.dumps(
|
||
|
|
{
|
||
|
|
"metrics": {
|
||
|
|
"vulnerability_recall": 1.0,
|
||
|
|
"false_positive_rate": 0.0,
|
||
|
|
"empirical_reproduction_rate": 1.0,
|
||
|
|
}
|
||
|
|
},
|
||
|
|
sort_keys=True,
|
||
|
|
)
|
||
|
|
)
|