54 lines
3.1 KiB
Python
54 lines
3.1 KiB
Python
"""Apply four reviewed source packages; no install, credentials or live effects."""
|
|
from datetime import datetime, timezone
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
TARGETS = (
|
|
('secrets-engine', 'decision-package', 'implementation-r1.patch',
|
|
'86179e607509d782f8a00012174c549997e0997ce4f84fc1078d245e4670a4ae',
|
|
'c80a944105a00220cd3c1a007709e72d830dd08d', 'coordinator-file-hashes.json', None),
|
|
('secrets-engine', 'decision-handoff', 'implementation-r2.patch',
|
|
'1ef8b67e2352415ddbdadc86cd151a8b6caf76628350657ed3e674aefcf49945',
|
|
'c80a944105a00220cd3c1a007709e72d830dd08d', 'integration-manifest-r2.json', 'files'),
|
|
('railiance-platform', 'protected-execution-wave4', 'platform-confirmation-seam.patch',
|
|
'f26a5e1f63f68c487930d3f076502f1bae73d16107d3be2537aeeda56e73628e',
|
|
'd042d468df6d4085bb93a73ec26f4c4103554575', 'manifest.json', 'files_sha256'),
|
|
('approval-engine', 'approval-confirmation', 'implementation.patch',
|
|
'a2dfa6585a8b97fc6facec7b0815ffc3374869b8de51cc696d534c69643e3621',
|
|
'8624fa20bbfb0c0329e5327b4dd8d8c05a312d7a', 'manifest.json', 'files'),
|
|
)
|
|
|
|
|
|
def main():
|
|
prepared = []
|
|
for repo, part, filename, expected, base, manifest_name, files_key in TARGETS:
|
|
owner, folder = Path('/home/worsch') / repo, ROOT / part
|
|
patch = folder / filename
|
|
assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected, repo
|
|
head = subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=owner, text=True).strip()
|
|
assert head == base, f'owner HEAD changed: {repo}'
|
|
manifest = json.loads((folder / manifest_name).read_text())
|
|
files = manifest[files_key] if files_key else manifest
|
|
assert not subprocess.check_output(['git', 'diff', 'HEAD', '--', *files], cwd=owner), f'target files dirty: {repo}'
|
|
for name in files:
|
|
tracked = subprocess.run(['git', 'ls-files', '--error-unmatch', name], cwd=owner, capture_output=True).returncode == 0
|
|
assert tracked or not (owner / name).exists(), f'untracked target collision: {repo}/{name}'
|
|
subprocess.run(['git', 'apply', '--check', str(patch)], cwd=owner, check=True)
|
|
prepared.append((repo, owner, folder, patch, expected, head, files))
|
|
for repo, owner, folder, patch, patch_hash, head, files in prepared:
|
|
subprocess.run(['git', 'apply', str(patch)], cwd=owner, check=True)
|
|
for name, expected in files.items():
|
|
assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == expected, name
|
|
receipt = {'repo': repo, 'base_commit': head, 'patch_sha256': patch_hash,
|
|
'integrated_at': datetime.now(timezone.utc).isoformat(), 'files_sha256': files,
|
|
'source_integrated': True, 'committed': False, 'published': False,
|
|
'native_accepted': False}
|
|
(folder / 'canonical-integration.json').write_text(json.dumps(receipt, indent=2) + '\n')
|
|
print(f'{repo}/{folder.name}: {len(files)} reviewed files integrated')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|