42 lines
1.6 KiB
Python
42 lines
1.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Validate the source-controlled policy-nexus production release identity."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
import re
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("binding", type=Path)
|
|
args = parser.parse_args()
|
|
binding = json.loads(args.binding.read_text(encoding="utf-8"))
|
|
|
|
if binding.get("schema_version") != "policy-nexus-production-binding/v1":
|
|
parser.error("unsupported policy-nexus binding schema")
|
|
if binding.get("status") != "release-approved":
|
|
parser.error("binding status must be release-approved")
|
|
if not re.fullmatch(r"sha256:[a-f0-9]{64}", binding.get("image_digest") or ""):
|
|
parser.error("binding image_digest must be sha256:<64 lowercase hex>")
|
|
if not re.fullmatch(
|
|
r"[a-f0-9]{64}", binding.get("publication_manifest_digest") or ""
|
|
):
|
|
parser.error("binding publication_manifest_digest must be 64 lowercase hex")
|
|
if not re.fullmatch(
|
|
r"[a-f0-9]{64}", binding.get("source_inventory_digest") or ""
|
|
):
|
|
parser.error("binding source_inventory_digest must be 64 lowercase hex")
|
|
if not re.fullmatch(r"[a-f0-9]{64}", binding.get("source_set_digest") or ""):
|
|
parser.error("binding source_set_digest must be 64 lowercase hex")
|
|
if binding.get("hostname") != "policy.coulomb.social":
|
|
parser.error("binding hostname must be policy.coulomb.social")
|
|
|
|
print("policy-nexus production binding is complete")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|