Function validate_result_row

scripts/ci/select-release-candidates.py:316–366

(row: dict[str, str], candidate: dict[str, str])

def validate_result_row(row: dict[str, str], candidate: dict[str, str]) -> None:
    scan_path = candidate["scan_path"]
    if (
        row["scan_path"] != scan_path
        or row["sha256"] != candidate["sha256"]
        or row["size"] != candidate["size"]
        or row["association_count"] != "1"
    ):
        raise ContractError(f"VT result is not bound to candidate object: {scan_path}")
    if SHA256_RE.fullmatch(row["sha256"]) is None:
        raise ContractError(f"VT result has invalid SHA-256: {scan_path}")

    completed = parse_nonnegative(row, "completed_engines", scan_path=scan_path)
    total = parse_nonnegative(row, "total_engines", scan_path=scan_path)
    malicious = parse_nonnegative(row, "malicious", scan_path=scan_path)
    suspicious = parse_nonnegative(row, "suspicious", scan_path=scan_path)
    # `total < completed` stays: that is an incoherent response. A low decisive
    # count does NOT — how many engines answered is VirusTotal fleet
    # availability on the day, not a property of this binary, and gating on it
    # made an 8-target release fail on a candidate with zero detections.
    if total < completed:
        raise ContractError(f"VT result has incoherent engine coverage: {scan_path}")
    if ANALYSIS_ID_RE.fullmatch(row["analysis_id"]) is None:
        raise ContractError(f"VT result has invalid analysis id: {scan_path}")
    for field in ("microsoft_engine_version", "microsoft_engine_update"):
        if not row[field] or any(ord(character) < 32 for character in row[field]):
            raise ContractError(f"VT result has incomplete Microsoft evidence: {scan_path}")
    expected_url = f"https://www.virustotal.com/gui/file/{row['sha256']}/detection"
    if row["virustotal_url"] != expected_url:
        raise ContractError(f"VT result URL is not content-bound: {scan_path}")

    classification = row["policy_classification"]
    if classification == "clean":
        coherent = (
            malicious == 0
            and suspicious == 0
            and row["microsoft_category"] in {"undetected", "harmless"}
            and row["microsoft_result"] == ""
        )
    elif classification == "microsoft-ml":
        coherent = (
            malicious == 1
            and suspicious == 0
            and row["microsoft_category"] == "malicious"
            and bool(row["microsoft_result"])
            and row["microsoft_result"].endswith("!ml")
        )
    else:
        raise ContractError(f"VT result is a hard or unknown policy block: {scan_path}")
    if not coherent:
        raise ContractError(f"VT classification contradicts its result details: {scan_path}")


def load_results(