Bind Policy Nexus production release

tools/check-policy-nexus-binding.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""Validate the source-controlled policy-nexus production release identity."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import re
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("binding", type=Path)
+    args = parser.parse_args()
+    binding = json.loads(args.binding.read_text(encoding="utf-8"))
+
+    if binding.get("schema_version") != "policy-nexus-production-binding/v1":
+        parser.error("unsupported policy-nexus binding schema")
+    if binding.get("status") != "release-approved":
+        parser.error("binding status must be release-approved")
+    if not re.fullmatch(r"sha256:[a-f0-9]{64}", binding.get("image_digest") or ""):
+        parser.error("binding image_digest must be sha256:<64 lowercase hex>")
+    if not re.fullmatch(
+        r"[a-f0-9]{64}", binding.get("publication_manifest_digest") or ""
+    ):
+        parser.error("binding publication_manifest_digest must be 64 lowercase hex")
+    if binding.get("hostname") != "policy.coulomb.social":
+        parser.error("binding hostname must be policy.coulomb.social")
+
+    print("policy-nexus production binding is complete")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())