iOS App 加固后怎样回归 App Attest：从 challenge 到服务端判定闭合证据

import hashlib
import json
import re
import sys
from pathlib import Path

REQUIRED = {
    'applicationId',
    'artifactSha256',
    'sessionRef',
    'purpose',
    'challengeRef',
    'keyRef',
    'assertionRef',
    'request',
    'expectedDigest',
    'challengeConsumed',
    'assertionVerified',
    'serverVerdict',
}
FORBIDDEN = {'privateKey', 'rawAttestation', 'rawAssertion', 'token', 'userData'}
SHA256 = re.compile(r'^[a-f0-9]{64}$')
VERDICTS = {'passed', 'rejected'}

def stop(message):
    raise SystemExit(message)

def stable_digest(value):
    body = json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=False)
    return hashlib.sha256(body.encode('utf-8')).hexdigest()

def validate(record, index):
    if not isinstance(record, dict):
        stop(f'record {index} is not an object')
    if FORBIDDEN.intersection(record):
        stop(f'record {index} contains forbidden fields')
    missing = sorted(REQUIRED - record.keys())
    if missing:
        stop(f'record {index} lacks fields: {missing}')
    if not SHA256.fullmatch(str(record['artifactSha256'])):
        stop(f'record {index} has invalid artifact digest')
    if not isinstance(record['request'], dict):
        stop(f'record {index} request is not an object')
    actual = stable_digest(record['request'])
    if actual != record['expectedDigest']:
        stop(f'record {index} request digest mismatches')
    if record['serverVerdict'] not in VERDICTS:
        stop(f'record {index} has invalid server verdict')
    if record['serverVerdict'] == 'passed':
        if record['challengeConsumed'] is not True:
            stop(f'record {index} passed without challenge consumption')
        if record['assertionVerified'] is not True:
            stop(f'record {index} passed without assertion verification')
    identity = (record['sessionRef'], record['purpose'])
    return record['challengeRef'], record['assertionRef'], identity

if len(sys.argv) != 2:
    stop('usage: validate_app_attest_fixture.py fixture.json')
source = Path(sys.argv[1])
if not source.is_file():
    raise SystemExit('fixture file is missing')
data = json.loads(source.read_text(encoding='utf-8'))
records = data.get('records') if isinstance(data, dict) else None
if not isinstance(records, list) or not records:
    raise SystemExit('fixture records are missing')
results = [validate(record, index) for index, record in enumerate(records)]
challenges = [item[0] for item in results]
assertions = [item[1] for item in results]
identities = [item[2] for item in results]
if len(challenges) != len(set(challenges)):
    raise SystemExit('fixture reuses a challenge reference')
if len(assertions) != len(set(assertions)):
    raise SystemExit('fixture reuses an assertion reference')
if len(identities) != len(set(identities)):
    raise SystemExit('fixture duplicates session and purpose')
print(json.dumps({'records': len(records), 'status': 'pass'}))