24 lines
1 KiB
Python
24 lines
1 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
"""Verify exact vendored producer bytes and optionally a prospective upstream.
|
||
|
|
|
||
|
|
Updates require reviewed replacement of API/sign files, fixture refresh from the
|
||
|
|
producer, and reviewed manifest hashes/revision; this checker never updates them.
|
||
|
|
"""
|
||
|
|
import argparse
|
||
|
|
import hashlib
|
||
|
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
parser=argparse.ArgumentParser()
|
||
|
|
parser.add_argument('--upstream',type=Path)
|
||
|
|
args=parser.parse_args()
|
||
|
|
root=Path(__file__).resolve().parents[1]
|
||
|
|
manifest=json.loads((root/'verifier/producer-source.json').read_text())
|
||
|
|
for name,digest in manifest['files'].items():
|
||
|
|
assert hashlib.sha256((root/'verifier'/name).read_bytes()).hexdigest()==digest, name
|
||
|
|
if args.upstream:
|
||
|
|
assert hashlib.sha256((args.upstream/name).read_bytes()).hexdigest()==digest, 'upstream drift: '+name
|
||
|
|
for name,digest in manifest['fixtures'].items():
|
||
|
|
assert hashlib.sha256((root/'tests/fixtures/pdp-signature'/name).read_bytes()).hexdigest()==digest, name
|
||
|
|
print('producer source and fixture hashes match the admitted source snapshot')
|