14 lines
2.4 KiB
Python
14 lines
2.4 KiB
Python
import json,subprocess,re,datetime
|
|
shell='set -eu\nbase=/data/git/gitea-repositories\nprintf \'repository_directory_count\\t\'\nfind "$base" -mindepth 2 -maxdepth 2 -type d -name \'*.git\' | wc -l\nfor name in access-engine approval-engine audit-core gate-house glas-harness key-cape kings-guard maturity-engine net-kingdom ops-mason ops-warden policy-nexus railiance-forge railiance-platform repo-manager role-engine secrets-engine security-canon tenant-engine the-custodian user-engine zone-engine; do\n repo="$base/coulomb/$name.git"\n if ! test -d "$repo"; then printf \'missing\\t%s\\n\' "$name"; continue; fi\n printf \'repo\\t%s\\n\' "$name"\n git --git-dir="$repo" config --get core.hooksPath || test "$?" = 1\n if test -n "$(find "$repo/hooks" -maxdepth 2 -type l -print -quit)"; then exit 77; fi\nfind "$repo/hooks" -maxdepth 2 -type f ! -name \'*.sample\' -exec sha256sum {} \\;\ndone\n'
|
|
r=subprocess.run(["kubectl","-n","forgejo","exec","forgejo-gitea-7d94988c79-8k76l","-c","gitea","--","sh","-c",shell],capture_output=True,text=True,timeout=60)
|
|
if r.returncode: raise SystemExit("Read-only hook inventory failed; raw diagnostics suppressed.")
|
|
rows=[];current=None;count=None
|
|
for line in r.stdout.splitlines():
|
|
if line.startswith("repository_directory_count\t"): count=int(line.split("\t")[1])
|
|
elif line.startswith("repo\t"):
|
|
current={"repo":line.split("\t")[1],"hook_files":[],"core_hooks_path":"unset"};rows.append(current)
|
|
elif line.startswith("missing\t"): rows.append({"repo":line.split("\t")[1],"missing":True})
|
|
elif re.fullmatch(r"[0-9a-f]{64} /data/git/gitea-repositories/coulomb/[a-z0-9_.-]+/hooks/[a-zA-Z0-9_./-]+",line):
|
|
digest,path=line.split(" ",1);current["hook_files"].append({"relative_path":path.split("/hooks/",1)[1],"sha256":digest})
|
|
else: raise SystemExit("Unrecognized metadata suppressed; no inventory claim.")
|
|
print(json.dumps({"observed_at":datetime.datetime.now(datetime.timezone.utc).isoformat(),"host":"railiance01","image":"code.forgejo.org/forgejo/forgejo:11.0.3-rootless","pod":"forgejo-gitea-7d94988c79-8k76l","repository_root":"/data/git/gitea-repositories","repository_directory_count":count,"repositories":rows,"scope":"Filesystem hook metadata for 22 reviewed repos only; directory count includes unmanaged/archived/wiki possibilities, not an admitted production denominator. Hashes do not establish scanner behavior or branch protection. No repository content, credentials, logs, database or remote mutation."},indent=2))
|