IQ.Pilot Release Commit @ 4fcea4d

system/proprietary_runtime/SConscript

@@ -0,0 +1,71 @@
+# Copyright © IQ.Lvbs, apart of Project Teal Lvbs, All Rights Reserved, licensed under https://konn3kt.com/tos
+import os
+import sysconfig
+
+Import('env', 'common')
+
+_PRIVATE_ROOT_RAW = os.environ.get("IQPILOT_PROPRIETARY_RUNTIME_SOURCE_ROOT", "").strip()
+_REQUIRE_PRIVATE_SOURCE = os.environ.get("IQPILOT_BUILD_PROPRIETARY_RUNTIME", "") == "1"
+_ALLOW_HOST_RUNTIME = os.environ.get("IQPILOT_BUILD_HOST_RUNTIME", "") == "1"
+_BUILD_NATIVE_RUNTIME = env["PLATFORM"] != "darwin" or _ALLOW_HOST_RUNTIME
+
+if _PRIVATE_ROOT_RAW:
+  from pathlib import Path
+  _PRIVATE_ROOT = Path(_PRIVATE_ROOT_RAW).resolve()
+  _PRIVATE_SOURCES = {
+    name: _PRIVATE_ROOT / name
+    for name in ("runner.cc", "bundle_common.cc", "bundle_common.h", "verified_import.cc")
+  }
+else:
+  _PRIVATE_ROOT = None
+  _PRIVATE_SOURCES = {}
+
+
+def _private_sources_ready() -> bool:
+  if _PRIVATE_ROOT is None:
+    if _REQUIRE_PRIVATE_SOURCE:
+      raise FileNotFoundError(
+        "IQPILOT_PROPRIETARY_RUNTIME_SOURCE_ROOT is not set"
+      )
+    print(env.PrettyNote('SKIP', "proprietary runtime native build — no private source root configured"))
+    return False
+
+  missing = [str(path) for path in _PRIVATE_SOURCES.values() if not path.exists()]
+  if not missing:
+    return True
+
+  if _REQUIRE_PRIVATE_SOURCE:
+    raise FileNotFoundError(
+      "missing proprietary runtime source files:\n" + "\n".join(missing)
+    )
+  print(env.PrettyNote('SKIP', f"proprietary runtime native build — private source unavailable at {_PRIVATE_ROOT}"))
+  return False
+
+
+runner = None
+verified_import = None
+
+if not _BUILD_NATIVE_RUNTIME:
+  print(env.PrettyNote('SKIP', "proprietary runtime host build on darwin (IQPILOT_BUILD_HOST_RUNTIME=1 to override)"))
+elif _private_sources_ready():
+  runner = env.Program(
+    'iqpilot_bundle_runner',
+    [str(_PRIVATE_SOURCES["runner.cc"]), str(_PRIVATE_SOURCES["bundle_common.cc"])],
+    LIBS=common + ['json11', 'crypto', 'pthread'],
+  )
+
+  python_module_env = env.Clone()
+  python_module_env["SHLIBPREFIX"] = ""
+  python_module_env["SHLIBSUFFIX"] = ".so"
+  python_module_env.Append(CPPPATH=[sysconfig.get_paths()["include"], str(_PRIVATE_ROOT)])
+  python_module_env["LINKFLAGS"] = [flag for flag in python_module_env["LINKFLAGS"] if flag != "-Wl,--no-undefined"]
+  if python_module_env["PLATFORM"] == "darwin":
+    python_module_env.Append(LINKFLAGS=["-undefined", "dynamic_lookup"])
+
+  verified_import = python_module_env.SharedLibrary(
+    '_verified_import',
+    [str(_PRIVATE_SOURCES["verified_import.cc"]), str(_PRIVATE_SOURCES["bundle_common.cc"])],
+    LIBS=common + ['json11', 'crypto', 'pthread'],
+  )
+
+Export('runner', 'verified_import')

system/proprietary_runtime/__init__.py

@@ -0,0 +1,4 @@
+import os
+_ROOTFS_PKG = "/usr/libexec/iqpilot/python/openpilot/system/proprietary_runtime"
+if os.path.isdir(_ROOTFS_PKG) and _ROOTFS_PKG not in __path__:
+  __path__.append(_ROOTFS_PKG)

system/proprietary_runtime/install_verified_runtime.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+RUNTIME_ROOT="${IQPILOT_VERIFIED_RUNTIME_ROOT:-/usr/libexec/iqpilot}"
+PYTHON_ROOT="${RUNTIME_ROOT}/python"
+TARGET_EXT_DIR="${PYTHON_ROOT}/openpilot/system/proprietary_runtime"
+MANIFEST_SRC="${ROOT}/system/proprietary_runtime/rootfs_integrity.json"
+MANIFEST_SIG_SRC="${ROOT}/system/proprietary_runtime/rootfs_integrity.json.sig"
+
+RUNNER_SRC="${ROOT}/system/proprietary_runtime/iqpilot_bundle_runner"
+EXT_SRC="${ROOT}/system/proprietary_runtime/_verified_import.so"
+STUB_ROOT="${ROOT}/system/proprietary_runtime/rootfs_python"
+
+if [ ! -x "${RUNNER_SRC}" ]; then
+  echo "missing runner: ${RUNNER_SRC}"
+  exit 1
+fi
+
+if [ ! -f "${EXT_SRC}" ]; then
+  echo "missing extension: ${EXT_SRC}"
+  exit 1
+fi
+
+if [ ! -f "${MANIFEST_SRC}" ] || [ ! -f "${MANIFEST_SIG_SRC}" ]; then
+  if [ -n "${IQPILOT_SIGNING_KEY:-}" ]; then
+    "${ROOT}/.venv/bin/python" \
+      "${ROOT}/scripts/iqpilot/build_proprietary_runtime_manifest.py" \
+      --repo-root "${ROOT}" \
+      --output "${MANIFEST_SRC}"
+  fi
+fi
+
+if [ ! -f "${MANIFEST_SRC}" ] || [ ! -f "${MANIFEST_SIG_SRC}" ]; then
+  echo "missing rootfs runtime integrity manifest or signature"
+  exit 1
+fi
+
+sudo mount -o remount,rw /
+trap 'sudo mount -o remount,ro /' EXIT
+
+sudo mkdir -p "${RUNTIME_ROOT}" "${TARGET_EXT_DIR}"
+sudo install -m 0755 "${RUNNER_SRC}" "${RUNTIME_ROOT}/iqpilot_bundle_runner"
+sudo install -m 0755 "${EXT_SRC}" "${TARGET_EXT_DIR}/_verified_import.so"
+sudo install -m 0644 "${MANIFEST_SRC}" "${RUNTIME_ROOT}/runtime_integrity.json"
+sudo install -m 0644 "${MANIFEST_SIG_SRC}" "${RUNTIME_ROOT}/runtime_integrity.json.sig"
+sudo install -m 0644 "${STUB_ROOT}/openpilot/__init__.py" "${PYTHON_ROOT}/openpilot/__init__.py"
+sudo mkdir -p "${PYTHON_ROOT}/openpilot/system"
+sudo install -m 0644 "${STUB_ROOT}/openpilot/system/__init__.py" "${PYTHON_ROOT}/openpilot/system/__init__.py"
+sudo install -m 0644 "${STUB_ROOT}/openpilot/system/proprietary_runtime/__init__.py" "${TARGET_EXT_DIR}/__init__.py"
+
+echo "installed verified runtime to ${RUNTIME_ROOT}"

system/proprietary_runtime/rootfs_integrity.json

@@ -0,0 +1,53 @@
+{
+  "entries": [
+    {
+      "mode": 493,
+      "path": "iqpilot_bundle_runner",
+      "relative_to": "runtime_root",
+      "sha256": "dd8ed0489aacc49575bd757f2483402dc9fe58683207669a162aeba0dda74c7a",
+      "size": 952752
+    },
+    {
+      "mode": 420,
+      "path": "python/openpilot/__init__.py",
+      "relative_to": "runtime_root",
+      "sha256": "fd6a1be7b4975c58a149f5f8dfacab711537b623940e3fdca96942101ac1f7e5",
+      "size": 582
+    },
+    {
+      "mode": 420,
+      "path": "python/openpilot/system/__init__.py",
+      "relative_to": "runtime_root",
+      "sha256": "a5860ee80095d837d9b64cf56fddd3c7d3b059f7ae59b97e1ebd3e1de27e07f0",
+      "size": 604
+    },
+    {
+      "mode": 420,
+      "path": "python/openpilot/system/proprietary_runtime/__init__.py",
+      "relative_to": "runtime_root",
+      "sha256": "b60c14722a96c22f5ee9cf865d1bfcba9ca434b04a444d1a8de5692088bacf7e",
+      "size": 744
+    },
+    {
+      "mode": 493,
+      "path": "python/openpilot/system/proprietary_runtime/_verified_import.so",
+      "relative_to": "runtime_root",
+      "sha256": "7014c3e321e6744643d750ea83f8dd14ff813c3bb9224e6801e6e055f9e5d0a8",
+      "size": 979176
+    },
+    {
+      "mode": 420,
+      "path": "/usr/lib/systemd/system/hephaestusd.service",
+      "relative_to": "absolute",
+      "sha256": "24bf925bc7b9f4b93ea3d19f9eaf1af01de91a01981f02a2e9cfcc7b66910ae7",
+      "size": 1390
+    },
+    {
+      "mode": 420,
+      "path": "/usr/lib/systemd/system/ble-transportd.service",
+      "relative_to": "absolute",
+      "sha256": "3aa5901a5738c523c8e7fd66b28d2933b27dac7e826076c190e5fc087ef3a888",
+      "size": 1472
+    }
+  ]
+}

system/proprietary_runtime/rootfs_integrity.json.sig

@@ -0,0 +1 @@
+74sHLbUYrXE+APXRQnE3tQpb/65TISl/F8W1B2nkZv9WbZfcaTuz0i3Vmkzhtj9sfQF1iL5mazLAvhXKzslADA==

system/proprietary_runtime/rootfs_python/openpilot/__init__.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+def _resolve_source_pkg() -> Path:
+  raw_root = os.environ.get("IQPILOT_SOURCE_ROOT") or os.environ.get("OPENPILOT_SOURCE_ROOT") or "/data/openpilot/openpilot"
+  source_root = Path(raw_root)
+  if source_root.name == "openpilot":
+    return source_root
+  return source_root / "openpilot"
+
+
+def _extend_package_path() -> None:
+  source_pkg = _resolve_source_pkg()
+  if source_pkg.is_dir():
+    pkg_path = str(source_pkg)
+    if pkg_path not in __path__:
+      __path__.append(pkg_path)
+
+
+_extend_package_path()

system/proprietary_runtime/rootfs_python/openpilot/system/__init__.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+def _resolve_source_pkg() -> Path:
+  raw_root = os.environ.get("IQPILOT_SOURCE_ROOT") or os.environ.get("OPENPILOT_SOURCE_ROOT") or "/data/openpilot/openpilot"
+  source_root = Path(raw_root)
+  if source_root.name == "openpilot":
+    return source_root / "system"
+  return source_root / "openpilot" / "system"
+
+
+def _extend_package_path() -> None:
+  source_pkg = _resolve_source_pkg()
+  if source_pkg.is_dir():
+    pkg_path = str(source_pkg)
+    if pkg_path not in __path__:
+      __path__.append(pkg_path)
+
+
+_extend_package_path()

system/proprietary_runtime/rootfs_python/openpilot/system/proprietary_runtime/__init__.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from ._verified_import import import_verified_module
+
+
+def _resolve_source_pkg() -> Path:
+  raw_root = os.environ.get("IQPILOT_SOURCE_ROOT") or os.environ.get("OPENPILOT_SOURCE_ROOT") or "/data/openpilot/openpilot"
+  source_root = Path(raw_root)
+  if source_root.name == "openpilot":
+    return source_root / "system" / "proprietary_runtime"
+  return source_root / "openpilot" / "system" / "proprietary_runtime"
+
+
+def _extend_package_path() -> None:
+  source_pkg = _resolve_source_pkg()
+  if source_pkg.is_dir():
+    pkg_path = str(source_pkg)
+    if pkg_path not in __path__:
+      __path__.append(pkg_path)
+
+
+_extend_package_path()
+
+__all__ = ["import_verified_module"]

system/proprietary_runtime/runtime_paths.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+VERIFIED_RUNTIME_ROOT = Path("/usr/libexec/iqpilot")
+VERIFIED_RUNNER_PATH = VERIFIED_RUNTIME_ROOT / "iqpilot_bundle_runner"
+VERIFIED_PYTHON_ROOT = VERIFIED_RUNTIME_ROOT / "python"
+FALLBACK_RUNNER_PATH = Path("/data/openpilot/system/proprietary_runtime/iqpilot_bundle_runner")
+DEFAULT_SOURCE_ROOT = Path("/data/openpilot/openpilot")
+
+
+def verified_runtime_present() -> bool:
+  return VERIFIED_RUNNER_PATH.is_file() and os.access(VERIFIED_RUNNER_PATH, os.X_OK)
+
+
+def preferred_runner_path() -> Path:
+  if verified_runtime_present():
+    return VERIFIED_RUNNER_PATH
+  if os.getenv("IQPILOT_ALLOW_DEV_FALLBACKS") == "1" and FALLBACK_RUNNER_PATH.is_file():
+    return FALLBACK_RUNNER_PATH
+  return VERIFIED_RUNNER_PATH
+
+
+def preferred_pythonpath(existing: str = "") -> str:
+  parts: list[str] = []
+  if VERIFIED_PYTHON_ROOT.is_dir():
+    parts.append(str(VERIFIED_PYTHON_ROOT))
+  if existing:
+    parts.append(existing)
+  return ":".join(parts)