Patched code sample

import json
import base64
import hashlib
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.serialization import load_pem_public_key
from cryptography.exceptions import InvalidSignature

# In a real-world scenario, this public key would be securely stored in the
# robot's read-only firmware. It is used to verify that the program was signed
# by a trusted source (e.g., the Unitree marketplace or the user's paired app).
# An attacker tampering with the database on the phone would not have the
# corresponding private key, so they could not create a valid signature.
TRUSTED_PUBLIC_KEY_PEM = b"""
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy2SPNHf53tO6w7JqTyJ0
8nZ7/a2ETsJe4klj4/YHpgoOCrg0ryLgL2NKAjzA3z1c8Y8xJNoOB1LpHmG5bJjl
rquSHAY0fcaqU0TmMj+BicP5YhsAN58ndaCl4WcMxrH1d8yJdcnht32GNMscbw5j
t8aSdtr4fDA7xQYhrIHN+33JGOZ2wBZI5aaePTaVf3E5f7VzUxiq+7jVTVJ7eQ49
z8vO7j4wLD7Vz1t8e/Zp7YmF4n7eW3b3q2Q8Y3c/p9wG9sW0e8Y3c/p9wG9sW0e8
Y3c/p9wG9sW0e8Y3c/p9wG9sW0e8Y3c/p9wG9sW0e8Y3c/p9wG9sW0e8Y3c/p9w
G9sW0e8Y3c/p9wG9sW0e8Y3c/p9wG9sW0e8Y3c/p9wG9sW0e8Y3c/p9wG9sW0e8
CAwEAAQ==
-----END PUBLIC KEY-----
"""

def load_public_key():
    """Loads the trusted public key from the constant."""
    return load_pem_public_key(TRUSTED_PUBLIC_KEY_PEM)

def verify_program_integrity(py_code, signature_b64):
    """
    Verifies the integrity of the Python code using a digital signature.
    
    This is the core of the fix. Before executing any code, it checks that
    the code is accompanied by a valid signature created with the private key
    corresponding to our trusted public key.
    
    Args:
        py_code (str): The Python code to be executed.
        signature_b64 (str): The base64-encoded signature of the code.

    Returns:
        bool: True if the signature is valid, False otherwise.
    """
    try:
        public_key = load_public_key()
        signature = base64.b64decode(signature_b64)
        code_bytes = py_code.encode('utf-8')

        public_key.verify(
            signature,
            code_bytes,
            padding.PKCS1v15(),
            hashes.SHA256()
        )
        print("[ROBOT-FIXED] Signature verification successful.")
        return True
    except (InvalidSignature, ValueError, TypeError) as e:
        print(f"[ROBOT-FIXED] Signature verification FAILED: {e}")
        return False
    except Exception as e:
        print(f"[ROBOT-FIXED] An unexpected error occurred during verification: {e}")
        return False

def actuator_manager_execute(program_json_from_app):
    """
    Simulates the robot's actuator_manager.py receiving and executing a program.
    This fixed version includes an integrity check.
    
    The incoming JSON is expected to have 'pyCode' and 'signature' fields.
    """
    print(f"\n[ROBOT-FIXED] Received program data from app...")

    try:
        program_data = json.loads(program_json_from_app)
        py_code = program_data.get("pyCode")
        signature = program_data.get("signature")

        if not py_code or not signature:
            print("[ROBOT-FIXED] ERROR: Program data is missing 'pyCode' or 'signature'. Execution aborted.")
            return

    except json.JSONDecodeError:
        print("[ROBOT-FIXED] ERROR: Invalid JSON received from app. Execution aborted.")
        return

    # --- FIX IMPLEMENTATION ---
    # Before executing, verify the integrity of the code.
    if verify_program_integrity(py_code, signature):
        # Only if the signature is valid, proceed with execution.
        # This prevents tampered or unauthorized code from running.
        print("[ROBOT-FIXED] Integrity verified. Executing sandboxed code as root...")
        try:
            # In a real-world fix, exec() would be replaced by a proper,
            # heavily restricted sandbox environment to provide defense-in-depth.
            # For this demonstration, we show the guarded execution.
            restricted_globals = {
                "__builtins__": {
                    "print": print, "int": int, "str": str, "list": list, 
                    "dict": dict, "range": range, "True": True, "False": False
                    # Add other safe built-ins here
                },
                # Provide a safe, limited API to the robot's functions.
                "robot_api": {"move_forward": lambda: print("API: Moving forward.")}
            }
            exec(py_code, restricted_globals, {})
            print("[ROBOT-FIXED] Program execution finished.")
        except Exception as e:
            print(f"[ROBOT-FIXED] ERROR during sandboxed execution: {e}")
    else:
        # If the signature is invalid, refuse to run the code.
        print("[ROBOT-FIXED] CRITICAL: Integrity check failed. Malicious code execution prevented.")