railiance-apps/tools/check-policy-nexus-binding.py

#!/usr/bin/env python3
"""Validate the source-controlled policy-nexus production release identity."""

from __future__ import annotations

import argparse
import json
from pathlib import Path
import re


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("binding", type=Path)
    args = parser.parse_args()
    binding = json.loads(args.binding.read_text(encoding="utf-8"))

    if binding.get("schema_version") != "policy-nexus-production-binding/v1":
        parser.error("unsupported policy-nexus binding schema")
    if binding.get("status") != "release-approved":
        parser.error("binding status must be release-approved")
    if not re.fullmatch(r"sha256:[a-f0-9]{64}", binding.get("image_digest") or ""):
        parser.error("binding image_digest must be sha256:<64 lowercase hex>")
    if not re.fullmatch(
        r"[a-f0-9]{64}", binding.get("publication_manifest_digest") or ""
    ):
        parser.error("binding publication_manifest_digest must be 64 lowercase hex")
    if not re.fullmatch(
        r"[a-f0-9]{64}", binding.get("source_inventory_digest") or ""
    ):
        parser.error("binding source_inventory_digest must be 64 lowercase hex")
    if not re.fullmatch(r"[a-f0-9]{64}", binding.get("source_set_digest") or ""):
        parser.error("binding source_set_digest must be 64 lowercase hex")
    if binding.get("hostname") != "policy.coulomb.social":
        parser.error("binding hostname must be policy.coulomb.social")

    print("policy-nexus production binding is complete")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())