mirror of
https://github.com/signerless/llm-checker.git
synced 2026-10-19 09:54:45 +00:00
a2a3037e8f
Verify-before-load structural safety validation powered by modelvet (MIT, vendored at 748ac72), compiled to a 19.8 KB WebAssembly module shipped in the npm package — pure JavaScript, zero native dependencies. - New `verify <file>` command (exit 0=ACCEPT, 1=REJECT, 2=error; --json) - Verification gates: `installed --verify` audits installed model blobs; `ai-run --verify` refuses to run a REJECTED model after pull - New `structural_validation` policy rule (audit/enforce) with `verification` fields in audit export reports (JSON/CSV/SARIF) - New MCP tool `verify_model`; `verify` added to MCP CLI allowlist - `mcp-setup` is now multi-client: claude, codex, cursor, windsurf, gemini, kimi, grok, generic (with --apply/--npx/--json) - Shared Ollama blob resolver (src/security/ollama-blobs.js) - Vendored amalgamation + rebuild script (vendor/modelvet/, scripts/build-modelvet-wasm.sh) New tests: modelvet-verify, verify-gates, policy-structural-validation, mcp-multiclient. Full suite 53/53.
46 lines
1.9 KiB
Bash
Executable file
46 lines
1.9 KiB
Bash
Executable file
#!/bin/sh
|
|
# Build src/security/modelvet.wasm from the vendored modelvet amalgamation.
|
|
#
|
|
# modelvet is freestanding C11 (no libc, no heap), so it compiles to a
|
|
# self-contained wasm32 module with plain clang: no Emscripten runtime,
|
|
# no imports, deterministic output.
|
|
#
|
|
# Usage:
|
|
# scripts/build-modelvet-wasm.sh # local clang with wasm32 target
|
|
# scripts/build-modelvet-wasm.sh --docker # emscripten/emsdk docker image
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
VENDOR="$ROOT/vendor/modelvet"
|
|
OUT="$ROOT/src/security/modelvet.wasm"
|
|
IMAGE="emscripten/emsdk:3.1.74"
|
|
|
|
EXPORTS="--export-memory --export=mvet_heap_base --export=mvet_version \
|
|
--export=mvet_arena_bind --export=mvet_gguf_verify --export=mvet_st_verify"
|
|
|
|
build() {
|
|
# $1 = clang command, $2/$3 = paths to the sources as seen by that clang
|
|
"$1" --target=wasm32 -O2 -std=c11 -nostdlib -ffreestanding -fno-builtin \
|
|
-Wall -Wextra -Werror -Wconversion -Wshadow \
|
|
-I"$(dirname "$2")" \
|
|
-Wl,--no-entry -Wl,-z,stack-size=1048576 \
|
|
$(for e in $EXPORTS; do printf -- "-Wl,%s " "$e"; done) \
|
|
-o "$OUT" "$2" "$3"
|
|
}
|
|
|
|
if [ "${1:-}" = "--docker" ]; then
|
|
# The emsdk image keeps real clang under /emsdk/upstream/bin (not on PATH).
|
|
docker run --rm -v "$ROOT:/src" -w /src "$IMAGE" \
|
|
/emsdk/upstream/bin/clang --target=wasm32 -O2 -std=c11 -nostdlib -ffreestanding -fno-builtin \
|
|
-Wall -Wextra -Werror -Wconversion -Wshadow \
|
|
-Ivendor/modelvet \
|
|
-Wl,--no-entry -Wl,-z,stack-size=1048576 \
|
|
-Wl,--export-memory -Wl,--export=mvet_heap_base -Wl,--export=mvet_version \
|
|
-Wl,--export=mvet_arena_bind -Wl,--export=mvet_gguf_verify -Wl,--export=mvet_st_verify \
|
|
-o src/security/modelvet.wasm \
|
|
vendor/modelvet/modelvet.c vendor/modelvet/wasm-shim.c
|
|
else
|
|
build clang "$VENDOR/modelvet.c" "$VENDOR/wasm-shim.c"
|
|
fi
|
|
|
|
ls -l "$OUT"
|