tegwick
312ab97e87
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
13 lines
2.3 KiB
Python
13 lines
2.3 KiB
Python
from pathlib import Path
|
|
import subprocess,hashlib,json,datetime
|
|
root=Path('/tmp/infd-zlib-published-9b4bb25d');rev='9b4bb25d325698ae543e7e8a8a3c3592db1f58fc';repo='/home/worsch/informed-decision';config=json.loads((root/'image-manifest.json').read_text())['config']['digest'];docker=['docker','--config','/tmp/infd-purpose-published-verification/empty-docker-config','--host','unix:///var/run/docker.sock'];base='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
|
|
def source(path):return subprocess.check_output(['git','-C',repo,'show',rev+':'+path])
|
|
def run(image,src,args=()):
|
|
cmd=docker+['run','--rm','-i','--network','none','--read-only','--cpus','1','--memory','128m','--entrypoint','python',image,'-']+list(args)
|
|
r=subprocess.run(cmd,input=src,capture_output=True);assert r.returncode==0,(r.returncode,r.stderr.decode());return r.stdout
|
|
for image,name in [(base,'base-runtime.json'),('sha256:f2e07e3dd839b55afd5d517243a765a26965325e4e6750f508771ad556bd6d01','candidate-runtime.json')]:
|
|
(root/name).write_bytes(run(image,source('tools/zlib_overlay/check_runtime.py')))
|
|
(root/'runtime-comparison.json').write_bytes(run(base,source('tools/zlib_overlay/compare_runtime.py'),[(root/'base-runtime.json').read_text(),(root/'candidate-runtime.json').read_text()]))
|
|
(root/'installed-purpose.json').write_bytes(run('sha256:f2e07e3dd839b55afd5d517243a765a26965325e4e6750f508771ad556bd6d01',source('tools/purpose_overlay/check_installed.py')))
|
|
(root/'runtime-receipt.json').write_text(json.dumps({'revision':rev,'published_digest':'sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23','verified_registry_config_digest':config,'executed_loaded_daemon_id':'sha256:f2e07e3dd839b55afd5d517243a765a26965325e4e6750f508771ad556bd6d01','image_source':'actual anonymous verified descriptor/layer archive loaded locally','candidate_image_executed':True,'network':'none','read_only_root':True,'memory':'128MiB','cpus':1,'checker_source':'exact gitshow pinnedcommit','native_provider_test':False,'native_workload_changed':False,'database_or_admin_or_provider_credentials':False,'verified_utc':datetime.datetime.now(datetime.timezone.utc).isoformat()},indent=2)+'\n')
|
|
print((root/'runtime-comparison.json').read_text());print((root/'installed-purpose.json').read_text())
|