tegwick
9b4bb25d32
All checks were successful
Publish exact zlib-only remediation candidate / publish-candidate (push) Successful in 13s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
19 lines
1.2 KiB
Python
19 lines
1.2 KiB
Python
"""Exact public input verification only; signature verification remains mandatory in build."""
|
|
import hashlib,json,sys
|
|
from pathlib import Path
|
|
|
|
def verify(root):
|
|
pins=json.loads((root/'pins.json').read_text())
|
|
if set(pins['files'])!={'.dockerignore','Containerfile','zlib-1.3.2-r1.apk','APKINDEX.tar.gz'}:raise ValueError('unclosed inputs')
|
|
if pins['base_image']!='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a':raise ValueError('base pin changed')
|
|
for name,digest in pins['files'].items():
|
|
p=root/name
|
|
if p.is_symlink() or not p.is_file() or p.stat().st_size>1024*1024:raise ValueError('regular bounded source required')
|
|
if hashlib.sha256(p.read_bytes()).hexdigest()!=digest:raise ValueError('changed bytes')
|
|
digest=hashlib.sha256(json.dumps(pins['files'],sort_keys=True,separators=(',',':')).encode()).hexdigest()
|
|
if digest!=pins['context_sha256']:raise ValueError('context mismatch')
|
|
return {'context_sha256':digest,'input_files':4}
|
|
|
|
if __name__=='__main__':
|
|
try:print(json.dumps(verify(Path(sys.argv[1]))))
|
|
except Exception:raise SystemExit('exact build inputs refused') from None
|