20 lines
1.2 KiB
Python
20 lines
1.2 KiB
Python
|
"""Exact public input verification only; signature verification remains mandatory in build."""
|
||
|
|
import hashlib,json,sys
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
def verify(root):
|
||
|
|
pins=json.loads((root/'pins.json').read_text())
|
||
|
|
if set(pins['files'])!={'.dockerignore','Containerfile','zlib-1.3.2-r1.apk','APKINDEX.tar.gz'}:raise ValueError('unclosed inputs')
|
||
|
|
if pins['base_image']!='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a':raise ValueError('base pin changed')
|
||
|
|
for name,digest in pins['files'].items():
|
||
|
|
p=root/name
|
||
|
|
if p.is_symlink() or not p.is_file() or p.stat().st_size>1024*1024:raise ValueError('regular bounded source required')
|
||
|
|
if hashlib.sha256(p.read_bytes()).hexdigest()!=digest:raise ValueError('changed bytes')
|
||
|
|
digest=hashlib.sha256(json.dumps(pins['files'],sort_keys=True,separators=(',',':')).encode()).hexdigest()
|
||
|
|
if digest!=pins['context_sha256']:raise ValueError('context mismatch')
|
||
|
|
return {'context_sha256':digest,'input_files':4}
|
||
|
|
|
||
|
|
if __name__=='__main__':
|
||
|
|
try:print(json.dumps(verify(Path(sys.argv[1]))))
|
||
|
|
except Exception:raise SystemExit('exact build inputs refused') from None
|