34 lines
2.3 KiB
Python
34 lines
2.3 KiB
Python
"""Audit a completed strict receipt; never runs Cargo or polls active logs."""
|
|
from pathlib import Path
|
|
import hashlib, json, subprocess
|
|
base=Path(__file__).resolve().parent.parent
|
|
repo=base/'.local/as2-20260913'
|
|
folder=base/'.local/analysis-source-gates-20260913'
|
|
name='strict-b2c970b'
|
|
pin='b2c970b4673e062e47eadd12906d2316c4b1a7b3'
|
|
def digest(raw): return hashlib.sha256(raw).hexdigest()
|
|
record_raw=(folder/(name+'.result.json')).read_bytes()
|
|
record=json.loads(record_raw)
|
|
assert record['source']==record['head_after']==pin and record['exit']==0 and record['changed_inputs']==[]
|
|
assert record['command']==['cargo','clippy','--locked','-p','oa-core','--all-targets','--','-D','warnings']
|
|
assert record['artifacts']==[] and record['inputs']==name+'.inputs.json'
|
|
manifest_raw=(folder/record['inputs']).read_bytes()
|
|
manifest=json.loads(manifest_raw)
|
|
assert manifest['source']==pin and len(manifest['inputs'])==524
|
|
paths=subprocess.check_output(['git','ls-tree','-r','--name-only',pin,'Cargo.toml','Cargo.lock','rust-toolchain.toml','.cargo','build','crates','assets','docs','examples','harness/fixtures'],cwd=repo).decode().splitlines()
|
|
assert paths==[x['path'] for x in manifest['inputs']] and len(set(paths))==524
|
|
blobs=subprocess.check_output(['git','cat-file','--batch'],cwd=repo,input=''.join(f'{pin}:{p}\n' for p in paths).encode())
|
|
offset=0
|
|
for entry in manifest['inputs']:
|
|
end=blobs.index(b'\n',offset); _,kind,size=blobs[offset:end].split(); size=int(size)
|
|
raw=blobs[end+1:end+1+size]
|
|
assert kind==b'blob' and len(raw)==entry['bytes']==size and digest(raw)==entry['sha256'],entry['path']
|
|
offset=end+size+2
|
|
assert offset==len(blobs)
|
|
log_raw=(folder/(name+'.log')).read_bytes()
|
|
log=log_raw.decode()
|
|
assert 'Finished `dev` profile' in log and 'error:' not in log and 'warning:' not in log
|
|
report={'source':pin,'exit':record['exit'],'command':record['command'],'start':record['start'],'end':record['end'],'verified_git_blob_inputs':524,'changed_inputs':[],'result_sha256':digest(record_raw),'inputs_sha256':digest(manifest_raw),'log_sha256':digest(log_raw),'log':log,'scope':'Completed receipt/raw log/source-input audit; no compiler rerun, build reproduction or toolchain attestation.'}
|
|
with (base/'.local/analysis-source8-s2a-strict-audit-20260913.json').open('x',encoding='utf-8') as stream: json.dump(report,stream,indent=2)
|
|
print(json.dumps(report,indent=2))
|