36 lines
2 KiB
Python
36 lines
2 KiB
Python
"""Publish explicitly typed public asset digests, retaining byte-exact evidence."""
|
|
from pathlib import Path
|
|
import hashlib
|
|
import json
|
|
|
|
HERE = Path(__file__).resolve().parent
|
|
path = HERE / 'release-evidence/embedded-files.json'
|
|
raw = path.read_bytes()
|
|
records = json.loads(raw)
|
|
work = Path('/tmp/custodian-forgejo-release-r4')
|
|
verification = json.loads((HERE / 'release-evidence/verification.json').read_text())
|
|
sha = lambda data: hashlib.sha256(data).hexdigest()
|
|
assert sha(raw) == verification['embedded_file_manifest_sha256']
|
|
assert raw == (work / 'embedded-files.json').read_bytes()
|
|
for name, value in records.items():
|
|
assert sha((work / 'source' / name).read_bytes()) == value, name
|
|
assert sha((work / 'embedded-extracted' / name).read_bytes()) == value, name
|
|
published = (json.dumps({name: 'sha256:' + value for name, value in records.items()},
|
|
indent=2, sort_keys=True) + '\n').encode()
|
|
restored = (json.dumps({name: value.removeprefix('sha256:')
|
|
for name, value in json.loads(published).items()},
|
|
indent=2, sort_keys=True) + '\n').encode()
|
|
assert restored == raw
|
|
path.write_bytes(published)
|
|
(HERE / 'release-evidence/embedded-manifest-derivation.json').write_text(json.dumps({
|
|
'scope': 'Public generated/embedded asset SHA-256 identifiers only',
|
|
'assets_verified_against_both_actual_source_and_extracted_binary': len(records),
|
|
'runtime_original_manifest_sha256': 'sha256:' + sha(raw),
|
|
'published_manifest_sha256': 'sha256:' + sha(published),
|
|
'original_byte_exact_reconstructed': True,
|
|
'reconstruction': 'Remove the sha256: value prefix and serialize with json.dumps(indent=2, sort_keys=True) plus one newline.',
|
|
'runtime_verification_receipt_preserved': True,
|
|
'scanner_rules_or_allowlists_changed': False,
|
|
'credential_values_transformed': False,
|
|
}, indent=2) + '\n')
|
|
print(json.dumps({'public_asset_digests_verified': len(records), 'original_byte_exact_reconstructed': True}))
|