App 加固后 Android Keystore 密钥生成、签名与解密怎样回归

import json
import re
import sys
from pathlib import Path

REQUIRED_SCENARIOS = {
    'generate',
    'encrypt_decrypt',
    'sign_verify',
    'auth_rejected',
    'process_restore',
    'controlled_recovery',
}
SENSITIVE_FIELDS = {'keyMaterial', 'plaintext', 'token', 'privateKey'}

if len(sys.argv) != 2:
    raise SystemExit('usage: validate_keystore_matrix.py results.json')
input_path = Path(sys.argv[1])
if not input_path.is_file():
    raise SystemExit('results file is missing')
data = json.loads(input_path.read_text(encoding='utf-8'))
results = data.get('results')
if not isinstance(results, list) or not results:
    raise SystemExit('results array is missing')
profiles = {}
coverage = {}
for index, item in enumerate(results):
    if not isinstance(item, dict):
        raise SystemExit(f'result {index} is not an object')
    leaked = SENSITIVE_FIELDS.intersection(item)
    if leaked:
        raise SystemExit(f'result {index} contains sensitive fields: {sorted(leaked)}')
    required = {'candidateSha256', 'device', 'profile', 'scenario', 'operation', 'expected', 'actual'}
    if not required.issubset(item):
        raise SystemExit(f'result {index} is missing required fields')
    candidate = str(item['candidateSha256']).lower()
    if not re.fullmatch(r'[0-9a-f]{64}', candidate):
        raise SystemExit(f'result {index} has an invalid candidate digest')
    scenario = str(item['scenario'])
    if scenario not in REQUIRED_SCENARIOS:
        raise SystemExit(f'result {index} has an unknown scenario')
    profile = item['profile']
    if not isinstance(profile, dict):
        raise SystemExit(f'result {index} profile is not an object')
    profile_fields = {'id', 'alias', 'algorithm', 'purposes', 'authRequired'}
    if not profile_fields.issubset(profile):
        raise SystemExit(f'result {index} has an incomplete profile')
    profile_id = str(profile['id'])
    stable_profile = json.dumps(profile, ensure_ascii=False, sort_keys=True, separators=(',', ':'))
    if profile_id in profiles and profiles[profile_id] != stable_profile:
        raise SystemExit(f'profile {profile_id} changes between results')
    profiles[profile_id] = stable_profile
    coverage.setdefault(candidate, set()).add(scenario)
    if item['actual'] != item['expected']:
        error_type = str(item.get('errorType', '')).strip()
        if not error_type:
            raise SystemExit(f'result {index} failed without an error type')
for candidate, scenarios in coverage.items():
    missing = sorted(REQUIRED_SCENARIOS - scenarios)
    if missing:
        raise SystemExit(f'candidate {candidate} lacks scenarios: {missing}')
print(json.dumps({'candidates': len(coverage), 'profiles': len(profiles), 'status': 'pass'}))