57 lines
6 KiB
Python
57 lines
6 KiB
Python
from pathlib import Path
|
|
import difflib,hashlib,json,shutil
|
|
base=Path('/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17');p=base/'forgejo-private-input-r1';w=Path('/tmp/forgejo-private-work');source=Path('/tmp/forgejo-private-input-r1');p.mkdir(exist_ok=True)
|
|
def sha(x):return hashlib.sha256(x.read_bytes()).hexdigest()
|
|
def write(rel,data):
|
|
x=p/rel;x.parent.mkdir(parents=True,exist_ok=True);x.write_bytes(data)
|
|
paths=['cmd/admin_auth_oauth.go','cmd/admin_auth_oauth_secret_linux.go','cmd/admin_auth_oauth_secret_other.go','cmd/admin_auth_oauth_secret_linux_test.go']
|
|
records=[];patch=''
|
|
for name in paths:
|
|
old=base/'forgejo-required-claim-values-r1/postimages'/name;new=source/name
|
|
if old.exists():before=old.read_bytes();write('preimages/forgejo/'+name,before)
|
|
else:before=b''
|
|
after=new.read_bytes();write('postimages/forgejo/'+name,after)
|
|
patch+='diff --git a/'+name+' b/'+name+'\n'+''.join(difflib.unified_diff(before.decode().splitlines(True),after.decode().splitlines(True),fromfile='a/'+name if old.exists() else '/dev/null',tofile='b/'+name))
|
|
records.append({'path':name,'before_sha256':sha(old) if old.exists() else None,'after_sha256':sha(new)})
|
|
write('forgejo-private-input.patch',patch.encode())
|
|
patch='';chart_records=[]
|
|
for name in ['templates/_helpers.tpl','templates/gitea/deployment.yaml']:
|
|
old=w/'chart-original/gitea'/name;new=w/'chart/gitea'/name
|
|
write('preimages/chart/'+name,old.read_bytes());write('postimages/chart/'+name,new.read_bytes())
|
|
patch+='diff --git a/'+name+' b/'+name+'\n'+''.join(difflib.unified_diff(old.read_text().splitlines(True),new.read_text().splitlines(True),fromfile='a/'+name,tofile='b/'+name))
|
|
chart_records.append({'path':name,'before_sha256':sha(old),'after_sha256':sha(new)})
|
|
write('chart-private-input.patch',patch.encode())
|
|
patch='';shared_records=[]
|
|
for name in ['models/db/engine.go','models/db/sensitive_sql.go','models/db/sensitive_sql_test.go']:
|
|
old=Path('/tmp/forgejo-independent-r1/forgejo')/name;new=source/name
|
|
before=old.read_bytes() if old.exists() else b''
|
|
if old.exists():write('preimages/shared/'+name,before)
|
|
write('postimages/shared/'+name,new.read_bytes())
|
|
patch+='diff --git a/'+name+' b/'+name+'\n'+''.join(difflib.unified_diff(before.decode().splitlines(True),new.read_text().splitlines(True),fromfile='a/'+name if old.exists() else '/dev/null',tofile='b/'+name))
|
|
shared_records.append({'path':name,'before_sha256':sha(old) if old.exists() else None,'after_sha256':sha(new)})
|
|
write('shared-db-confidentiality.patch',(base/'apps-operation-backend-r1/forgejo-private-query-common.patch').read_bytes())
|
|
protected={}
|
|
for name in ['forgejo-required-claim-values-r1','forgejo-required-claim-values-review-r1','apps-forgejo-release-build-r1','apps-chart-projection-r1']:
|
|
root=base/name;manifest=root/'SHA256SUMS.json'
|
|
if manifest.exists():
|
|
rows=json.loads(manifest.read_text());fail=[n for n,d in rows.items() if sha(root/n)!=d.removeprefix("sha256:")]
|
|
if name != 'apps-chart-projection-r1':assert not fail,(name,fail)
|
|
protected[name]={'manifest_sha256':sha(manifest),'verified_entries':len(rows)-len(fail),'all_unchanged':not fail,'preexisting_mismatches':{n:{'expected':rows[n],'actual':sha(root/n)} for n in fail}}
|
|
else:protected[name]={'exact_files':{str(x.relative_to(root)):sha(x) for x in sorted(root.rglob('*')) if x.is_file()}}
|
|
preserved={}
|
|
for x in (base/'forgejo-required-claim-values-r1/postimages').rglob('*'):
|
|
if x.is_file() and str(x.relative_to(base/'forgejo-required-claim-values-r1/postimages')) not in paths:
|
|
name=str(x.relative_to(base/'forgejo-required-claim-values-r1/postimages'));assert sha(x)==sha(source/name),name;preserved[name]=sha(x)
|
|
write('source-inventory.json',(json.dumps({'schema':'custodian.forgejo-private-input-source.v1','base_forgejo':'11.0.3','base_tree':'b81aa4d0807cc1e2d6a2fbafd0b75c46cc0ae237','official_archive_sha256':sha(Path('/tmp/forgejo-independent-r1/forgejo-v11.0.3.tar.gz')),'reviewed_base_patch_sha256':sha(base/'forgejo-required-claim-values-r1/forgejo-source.patch'),'new_patch_sha256':sha(p/'forgejo-private-input.patch'),'forgejo_changes':records,'chart_version':'12.5.0','official_chart_archive_sha256':sha(base/'apps-chart-projection-r1/upstream/gitea-12.5.0.tgz'),'chart_changes':chart_records,'shared_db_dependency':shared_records,'shared_db_dependency_patch_sha256':sha(p/'shared-db-confidentiality.patch'),'preserved_reviewed_source_paths':preserved,'protected_packets':protected,'public_sources_only':True,'canonical_source_changes':False,'image_rebuilt':False},indent=2)+'\n').encode())
|
|
for name in ['keycape_client_secret_generate.py']:
|
|
write('evidence/public-source/'+name,(Path('/home/worsch/railiance-platform/scripts')/name).read_bytes())
|
|
for x in w.glob('kubernetes-*.go'):write('evidence/public-source/'+x.name,x.read_bytes())
|
|
for name in ['build.py','test_cli.py','test_chart.py','test_packages.py']:
|
|
write('tests/'+name,(w/name).read_bytes())
|
|
for name in ['reviewer_cmd_test.go','reviewer_oauth2_test.go']:
|
|
write('tests/base-review/'+name,(base/'forgejo-required-claim-values-review-r1'/name).read_bytes())
|
|
for name in ['build.log','build-result.json','build-result-before-fd-helper.json','build-final-driver.log','packages.log','packages-result.json','packages-result-before-final.json','packages-final-driver.log','package-race-attempt.log','cli-attempt1.log','cli-attempt2.log','cli-final.log','cli-results.json','cli-attempts.json','chart-attempt1.log','chart-attempt2.log','chart-attempt3.log','chart-results.json','chart-attempts.json','sandbox.json','env.json','cli-repeat-fixture-failure.log','cli-final-subpath.log','chart-metadata-reconstruction.json','chart-source-inventory-original.json','source-tree-audit.json','sql-leak-before.log','sandbox-before-pid.json','build-result-before-sql-hooks.json','packages-result-before-sql-hooks.json','build-final-sql-driver.log','packages-final-sql-driver.log','chart-final-pid.log','cli-final-sql.log','replay-driver.log']:
|
|
x=w/name
|
|
if x.exists():write('evidence/'+name,x.read_bytes())
|
|
write('tests/package.py',Path(__file__).read_bytes())
|
|
print('packet prepared',len(records),'Forgejo paths',len(chart_records),'chart paths')
|