tegwick
ea2d4632a1
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
38 lines
2.8 KiB
Python
38 lines
2.8 KiB
Python
"""Approved preparation only: execute in verified hardened API pod after phase B.
|
|
stdin envelope contains only three base64-encoded hash-bound non-secret packets.
|
|
No token accepted; native module consumes its reviewed runtime source credential.
|
|
"""
|
|
import base64,hashlib,json,os,tempfile
|
|
from pathlib import Path
|
|
import sys
|
|
from reuse_surface import federation, private_source_verify as native
|
|
EXPECTED={'proposal':'7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99','disclosure':'46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35','consent':'4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52'}
|
|
FEDI='dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd'
|
|
NATIVE='c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c'
|
|
receipt={'id':'CUST81-NATIVE-RUNTIME-PROOF-R1','status':'unverified','raw_errors_or_values_emitted':False}
|
|
try:
|
|
source_sha=hashlib.sha256(Path(federation.__file__).read_bytes()).hexdigest()
|
|
helper_sha=hashlib.sha256(Path(native.__file__).read_bytes()).hexdigest()
|
|
assert source_sha==FEDI and helper_sha==NATIVE
|
|
envelope=json.loads(sys.stdin.buffer.read(1048576))
|
|
assert set(envelope)==set(EXPECTED)
|
|
with tempfile.TemporaryDirectory(prefix='cust81-native-packets-') as temporary:
|
|
paths={}
|
|
for name,digest in EXPECTED.items():
|
|
content=base64.b64decode(envelope[name],validate=True)
|
|
assert hashlib.sha256(content).hexdigest()==digest
|
|
p=Path(temporary)/(name+'.json');p.write_bytes(content);p.chmod(0o600);paths[name]=p
|
|
sources=list(native._prepared_sources(paths['proposal'],paths['disclosure'],paths['consent']))
|
|
expected_urls={native._raw_url(source['repo'],source['consented_commit'],path) for source,files in sources for path in files}
|
|
allow=json.loads(os.environ.get('REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST','{}'))
|
|
assert set(allow)=={native.AUTH_ENV} and len(allow[native.AUTH_ENV])==14 and set(allow[native.AUTH_ENV])==expected_urls
|
|
# Presence only: never print/read the secret value here. Native acquisition
|
|
# is subsequently performed only at its reviewed exact URL routing boundary.
|
|
key_present=native.AUTH_ENV in os.environ
|
|
assert key_present
|
|
result=native.verify(paths['proposal'],paths['disclosure'],paths['consent'])
|
|
receipt.update(source_sha256=source_sha,helper_sha256=helper_sha,packet_sha256=EXPECTED,runtime_allowlist_exact14=True,reader_key_present=True,native_fetch=result,status='verified' if result['all_verified'] else 'native_fetch_failed')
|
|
except Exception:
|
|
receipt.update(status='runtime_or_native_proof_refused',error='hash_scope_or_native_validation_failed')
|
|
print(json.dumps(receipt,sort_keys=True))
|
|
raise SystemExit(0 if receipt['status']=='verified' else 1)
|