137 lines
7.3 KiB
Python
137 lines
7.3 KiB
Python
"""Archive/recheck an explicit closed packaging evidence allowlist; no runtime execution."""
|
|
from pathlib import Path
|
|
import datetime
|
|
import hashlib
|
|
import json
|
|
import sys
|
|
|
|
HERE = Path(__file__).resolve().parent
|
|
ROOT = HERE.parents[4]
|
|
LOCAL = ROOT / '.local'
|
|
WORK = LOCAL / 'canvas-union-ytr83r-20260911'
|
|
OLD = LOCAL / 'native-repair-union-33e30c1'
|
|
NEW = LOCAL / 'native-repair-union-33e30c1-r2'
|
|
GATES = LOCAL / 'repair-union-windows-20260911'
|
|
NAME = 'ArcadiaStudio-0.2.0-preview.canvas-repair.20260912-x86_64-pc-windows-gnullvm'
|
|
STAGE = NEW / 'dist' / NAME
|
|
SOURCE = '33e30c1cd7a6c99513a0ebd02ba68fccbad8f58d'
|
|
|
|
|
|
def require(condition, message):
|
|
if not condition:
|
|
raise RuntimeError(message)
|
|
|
|
|
|
def sha(data):
|
|
return hashlib.sha256(data).hexdigest()
|
|
|
|
|
|
def now():
|
|
return datetime.datetime.now(datetime.timezone.utc).isoformat()
|
|
|
|
|
|
def write_new(path, record):
|
|
with path.open('x', encoding='utf-8', newline='\n') as stream:
|
|
json.dump(record, stream, indent=2)
|
|
stream.write('\n')
|
|
|
|
|
|
def inputs():
|
|
files = []
|
|
def add(origin, target):
|
|
files.append((origin, 'payload/' + target))
|
|
for name in ('preflight.py', 'PREPARATION.md', 'attempt/failure.json', 'attempt/package-transcript.log'):
|
|
add(OLD / name, 'initial-attempt/' + name)
|
|
add(LOCAL / 'package-preview-repair-union.ps1', 'initial-attempt/package-preview.ps1')
|
|
add(LOCAL / 'extract-preview-repair-union.py', 'initial-attempt/extract-preview.py')
|
|
for name in ('preflight.py', 'PREPARATION.md', 'adapter-delta.diff', 'preparation-inputs.json',
|
|
'timestamp-checks.json', 'full-preflight-status.json', 'full-preflight.stdout.json',
|
|
'full-preflight.stderr.log', 'package-build-evidence.json', 'package-result.json',
|
|
'extraction-readback.json', 'attempt/preflight.json', 'attempt/postflight.json',
|
|
'attempt/package-transcript.log'):
|
|
add(NEW / name, 'r2/' + name)
|
|
add(LOCAL / 'package-preview-repair-union-r2.ps1', 'r2/package-preview.ps1')
|
|
add(LOCAL / 'extract-preview-repair-union-r2.py', 'r2/extract-preview.py')
|
|
for name in ('inputs.json', 'binary-manifest.json', 'environment.json', 'verify-after-build.json',
|
|
'focused-status.json', 'desktop-tests-status.json', 'desktop-clippy-status.json',
|
|
'studio-build-status.json'):
|
|
add(GATES / name, 'source-build/' + name)
|
|
add(LOCAL / 'server-windows-321897f/manifest.json', 'source-build/server-component-manifest.json')
|
|
add(LOCAL / 'toolchain/env.ps1', 'source-build/toolchain-env.ps1')
|
|
for name in ('package-windows.ps1', 'package-common.ps1', 'package-artifacts.py',
|
|
'windows-notices.ps1', 'windows-notices/manifest.json'):
|
|
add(WORK / 'scripts' / name, 'packager/' + name)
|
|
for name in ('package.json', 'dependency-notices.json', 'documentation-check.json',
|
|
'SHA256SUMS.txt'):
|
|
add(STAGE / name, 'package/' + name)
|
|
add(NEW / 'dist' / (NAME + '.zip.sha256'), 'package/' + NAME + '.zip.sha256')
|
|
return files
|
|
|
|
|
|
def archive():
|
|
require(not (HERE / 'payload').exists() and not (HERE / 'manifest.json').exists(), 'Archive output exists')
|
|
result = json.loads((NEW / 'package-result.json').read_text(encoding='utf-8-sig'))
|
|
extraction = json.loads((NEW / 'extraction-readback.json').read_text(encoding='utf-8-sig'))
|
|
require(result['exit'] == 0 and extraction['exit'] == 0 and result['source_commit'] == SOURCE,
|
|
'Only successful closed producer/extraction receipts may be archived')
|
|
require(result['result']['SHA256'] == extraction['archive_sha256'] ==
|
|
'1e962fadce47922bdcf69e0e1d89e144e582083d940f4c9c9a5c6fbfece95c24', 'Package identity differs')
|
|
require(result['result']['Files'] == len(extraction['files']) == 559, 'Package count differs')
|
|
require((NEW / 'attempt/package-transcript.log').read_text(encoding='utf-8-sig').rstrip().endswith('**********************'),
|
|
'Producer transcript not closed')
|
|
records = []
|
|
for origin, relative in inputs():
|
|
require(origin.is_file() and origin.suffix.lower() not in ('.exe', '.dll', '.zip'), f'Forbidden/missing input: {origin}')
|
|
before = origin.read_bytes()
|
|
target = HERE / relative
|
|
target.parent.mkdir(parents=True, exist_ok=True)
|
|
with target.open('xb') as stream:
|
|
stream.write(before)
|
|
copied = target.read_bytes()
|
|
after = origin.read_bytes()
|
|
require(before == copied == after, f'Input/copy changed: {origin}')
|
|
records.append({'origin': str(origin), 'path': relative, 'bytes': len(before),
|
|
'original_sha256': sha(before), 'copy_sha256': sha(copied),
|
|
'original_after_sha256': sha(after)})
|
|
manifest = {'created_utc': now(), 'source_commit': SOURCE,
|
|
'scope': 'Exact closed package-production/extraction receipts; initial failure retained; no runtime acceptance',
|
|
'package_sha256': result['result']['SHA256'], 'package_bytes': 32752913,
|
|
'package_files': 559, 'payload_files': len(records),
|
|
'payload_bytes': sum(r['bytes'] for r in records), 'files': records}
|
|
write_new(HERE / 'manifest.json', manifest)
|
|
print(json.dumps({k: v for k, v in manifest.items() if k != 'files'}))
|
|
|
|
|
|
def verify():
|
|
require(not (HERE / 'readback.json').exists(), 'Readback already exists; never overwrite')
|
|
raw_manifest = (HERE / 'manifest.json').read_bytes()
|
|
manifest = json.loads(raw_manifest)
|
|
payloads = []
|
|
for item in manifest['files']:
|
|
original = Path(item['origin']).read_bytes()
|
|
copied = (HERE / item['path']).read_bytes()
|
|
require(original == copied and len(copied) == item['bytes'] and
|
|
sha(copied) == item['original_sha256'] == item['copy_sha256'] == item['original_after_sha256'],
|
|
f'Closed payload readback differs: {item["path"]}')
|
|
payloads.append({'path': item['path'], 'bytes': len(copied), 'sha256': sha(copied)})
|
|
expected = {item['path'] for item in manifest['files']} | {'README.md', 'archive-closed.py', 'manifest.json'}
|
|
actual = {path.relative_to(HERE).as_posix() for path in HERE.rglob('*') if path.is_file()}
|
|
require(actual == expected, f'Archive inventory differs: {sorted(actual ^ expected)}')
|
|
metadata = []
|
|
for name in ('README.md', 'archive-closed.py', 'manifest.json'):
|
|
data = (HERE / name).read_bytes()
|
|
metadata.append({'path': name, 'bytes': len(data), 'sha256': sha(data)})
|
|
require(raw_manifest == (HERE / 'manifest.json').read_bytes(), 'Manifest changed during verification')
|
|
record = {'checked_utc': now(), 'pass': True,
|
|
'scope': 'Separate-process second read of originals/copies and exact final archive inventory; no package/runtime rerun',
|
|
'payload_files': len(payloads), 'payload_bytes': sum(p['bytes'] for p in payloads),
|
|
'final_file_count_including_this_receipt': len(expected) + 1,
|
|
'manifest_sha256': sha(raw_manifest), 'payloads': payloads, 'metadata': metadata}
|
|
write_new(HERE / 'readback.json', record)
|
|
print(json.dumps({k: v for k, v in record.items() if k not in ('payloads', 'metadata')}))
|
|
|
|
|
|
if __name__ == '__main__':
|
|
require(len(sys.argv) == 2 and sys.argv[1] in ('archive', 'verify'), 'Use archive or verify')
|
|
archive() if sys.argv[1] == 'archive' else verify()
|