Poc Repro Verify

PoC Reproduction Verifier

Workflow

1. Build or collect commit metadata (owner, repo, sha) from a GitHub commit URL.
2. Prepare a deterministic verification command (check-cmd) that returns machine-checkable exit status.
3. Optionally prepare environment setup command (setup-cmd) for build/dependency bootstrap.
4. Run scripts/verify_repro.py to execute checks on:

• vulnerable revision: <sha>^
• patched revision: <sha>

5. Review verification-report.json and verification-report.md.
6. Report final verdict with explicit assumptions and safety boundaries.

Inputs

Minimum required:

• GitHub commit URL or meta.json
• Verification command (--check-cmd)

Optional:

• Setup command (--setup-cmd)
• PoC script to stage into both revisions (--poc-script)
• Repo URL override for forks/mirrors (--repo-url)
• Verdict mode (--verdict-mode)

Commands

1) Create metadata from commit URL

python3 scripts/make_meta.py <commit_url> --out ./artifacts/commit-meta.json

2) Run real verification

python3 scripts/verify_repro.py \
  --meta ./artifacts/commit-meta.json \
  --check-cmd "<your-check-command>" \
  --verdict-mode different_exit_codes \
  --work-dir ./verify-work

3) Verify a generated PoC script directly

python3 scripts/verify_repro.py \
  --meta ./artifacts/commit-meta.json \
  --poc-script ./poc_generated.py \
  --check-cmd "python3 ./poc_generated.py --target localhost --mode check" \
  --verdict-mode vuln_zero_patched_nonzero

Verdict Modes

• different_exit_codes: vulnerable and patched exits must differ
• vuln_nonzero_patched_zero: vulnerable should fail, patched should pass
• vuln_zero_patched_nonzero: vulnerable should pass, patched should fail
• same_exit_codes: both should match (control checks)

Pick the mode that reflects the PoC success definition.

Output Requirements

Always include:

• commit URL and revisions used
• exact commands executed
• vulnerable and patched exit codes
• selected verdict mode and final PASS/FAIL
• key assumptions and known limitations

Use verification-template.md as final reporting structure.

Safety Rules

• Run only in local/disposable and authorized environments.
• Do not target production or unauthorized third-party assets.
• Keep payloads minimal and non-destructive.
• Separate "proof of behavior" from exploit escalation.

Resource Usage

• Use make_meta.py when only commit URL is provided.
• Use verify_repro.py as the primary execution engine.
• Use verification-template.md to normalize output.

Quality Checklist

Before finalizing:

• check-cmd is deterministic and bounded by timeout
• vulnerable and patched revisions are correct
• verdict mode matches expected vulnerability behavior
• report includes both raw command results and interpretation