68 lines
4.1 KiB
Python
68 lines
4.1 KiB
Python
"""Integrate reviewed source only; preserve all unrelated owner edits."""
|
|
from datetime import datetime, timezone
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
TARGETS = (
|
|
("approval-engine", "approval-reference", "implementation.patch",
|
|
"a6bf77fa8b6916f423db7832f475e38747b828dd632a88f9631131e28e3230ee",
|
|
"9491d1d3a7b6554fa04f8dc06f65d50e3d6ee4e1", "files"),
|
|
("ops-mason", "mason-browser", "implementation.patch",
|
|
"cfe7648ed119d83faca228a2f21611c9388de1ba166598cbeb64f40e81620067",
|
|
"e4761b843cd881a672cbb33a5b451de31a61d730", "changed_source"),
|
|
("railiance-platform", "protected-execution-wave3", "platform-grant-projection.patch",
|
|
"d91fdbd68b328d430e0e2b0b7f44d552095b8688ae4942d398d2e126b3648ad5",
|
|
"4021ca5e79d3f85197b26cc20d29c55771462cf1", "files_sha256"),
|
|
("access-engine", "access-verifier-review", "producer-signing-r2.patch",
|
|
"25e05b04f96cfe6f7d1abb11ab5d533b14a830c437136fc78aa381198ff8db37",
|
|
"62ac2b4e99dec2005c7c407fe633612578a7907d", "source_files"),
|
|
)
|
|
|
|
|
|
def main():
|
|
prepared = []
|
|
for repo, part, filename, expected, base, files_key in TARGETS:
|
|
owner, folder = Path("/home/worsch") / repo, ROOT / part
|
|
patch = folder / filename
|
|
assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected, repo
|
|
head = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=owner, text=True).strip()
|
|
assert head == base, f"owner revision changed: {repo}"
|
|
manifest = "manifest-r2.json" if repo == "access-engine" else "manifest.json"
|
|
files = json.loads((folder / manifest).read_text())[files_key]
|
|
assert not subprocess.check_output(["git", "diff", "HEAD", "--", *files], cwd=owner), f"target files dirty: {repo}"
|
|
for name in files:
|
|
tracked = subprocess.run(["git", "ls-files", "--error-unmatch", name], cwd=owner, capture_output=True).returncode == 0
|
|
assert tracked or not (owner / name).exists(), f"untracked target collision: {repo}/{name}"
|
|
subprocess.run(["git", "apply", "--check", str(patch)], cwd=owner, check=True)
|
|
prepared.append((repo, owner, folder, patch, expected, head, files))
|
|
# Secrets R2 is deliberately still uncommitted after two public-ID scanner
|
|
# false positives. Apply only the reviewed naming delta to those exact bytes.
|
|
owner, folder = Path("/home/worsch/secrets-engine"), ROOT / "decision-auth"
|
|
manifest = json.loads((folder / "integration-manifest-r3.json").read_text())
|
|
patch = folder / "implementation-r3-delta.patch"
|
|
expected = "b6c944fee615298a29dbd50ba0ad437ff76e6eab190f6168427e4ae5dbbfc59c"
|
|
assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected
|
|
for name, hashes in manifest["files"].items():
|
|
assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == hashes["r2_sha256"], name
|
|
subprocess.run(["git", "apply", "--check", str(patch)], cwd=owner, check=True)
|
|
head = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=owner, text=True).strip()
|
|
prepared.append(("secrets-engine", owner, folder, patch, expected, head,
|
|
{name: hashes["r3_sha256"] for name, hashes in manifest["files"].items()}))
|
|
for repo, owner, folder, patch, patch_hash, head, files in prepared:
|
|
subprocess.run(["git", "apply", str(patch)], cwd=owner, check=True)
|
|
for name, expected in files.items():
|
|
assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == expected.removeprefix("sha256:"), name
|
|
receipt = {"repo": repo, "base_commit": head, "patch_sha256": patch_hash,
|
|
"integrated_at": datetime.now(timezone.utc).isoformat(), "files_sha256": files,
|
|
"source_integrated": True, "committed": False, "published": False,
|
|
"native_accepted": False}
|
|
name = "canonical-integration-r3.json" if repo == "secrets-engine" else "canonical-integration.json"
|
|
(folder / name).write_text(json.dumps(receipt, indent=2) + "\n")
|
|
print(f"{repo}: {len(files)} exact reviewed source files integrated")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|