64 lines
3.4 KiB
Python
64 lines
3.4 KiB
Python
"""Integrate three reviewed source packages; never deploy or admit credentials."""
|
|
from datetime import datetime, timezone
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
TARGETS = (
|
|
('railiance-platform', 'protected-execution-wave5', 'platform-wave5.patch',
|
|
'b4c44a452a1b62d0a2c114e2de60537666a139a387c478c663236b3aacdaadec',
|
|
'5f30ddd90c33e7eb1b9efa1093c7324d83210cf2', 'manifest.json', 'files'),
|
|
('access-engine', 'access-native-source', 'source-preparation-r2.patch',
|
|
'cee7af8e1e8ee8b63f9d5bc5927a6d89ae6c1169b3ec23f59e0958664fc91dca',
|
|
'ec21518e25df2a58444f19ff3413ce0b83383d3c', 'manifest-r2.json', 'source_files_sha256'),
|
|
('secrets-engine', 'decision-native-preparation', 'implementation-r1.patch',
|
|
'316daaba4afa309b2f13acf995f781d9fae1ea84e12837a8b494e31b8489dd46',
|
|
'ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225', 'integration-manifest-r1.json', 'files'),
|
|
)
|
|
|
|
|
|
def digest(path):
|
|
return hashlib.sha256(path.read_bytes()).hexdigest() if path.exists() else None
|
|
|
|
|
|
def main():
|
|
prepared = []
|
|
for repo, part, filename, patch_hash, head, manifest_name, key in TARGETS:
|
|
owner, folder = Path('/home/worsch') / repo, ROOT / part
|
|
assert not (folder / 'canonical-integration.json').exists(), 'already integrated'
|
|
patch = folder / filename
|
|
assert digest(patch) == patch_hash, repo
|
|
assert subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=owner, text=True).strip() == head, repo
|
|
files = json.loads((folder / manifest_name).read_text())[key]
|
|
assert not subprocess.check_output(['git', 'diff', 'HEAD', '--', *files], cwd=owner), repo
|
|
after = {}
|
|
before = {}
|
|
for name, expected in files.items():
|
|
assert not Path(name).is_absolute() and '..' not in Path(name).parts
|
|
tracked = subprocess.run(['git', 'ls-files', '--error-unmatch', name], cwd=owner, capture_output=True).returncode == 0
|
|
assert tracked or not (owner / name).exists(), name
|
|
before[name] = digest(owner / name)
|
|
if isinstance(expected, dict):
|
|
assert before[name] == expected['before_sha256'], name
|
|
expected = expected['after_sha256']
|
|
after[name] = expected
|
|
subprocess.run(['git', 'apply', '--check', str(patch)], cwd=owner, check=True)
|
|
prepared.append((repo, owner, folder, patch, patch_hash, head, before, after))
|
|
for repo, owner, folder, patch, patch_hash, head, before, after in prepared:
|
|
assert subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=owner, text=True).strip() == head
|
|
assert all(digest(owner / name) == value for name, value in before.items())
|
|
subprocess.run(['git', 'apply', str(patch)], cwd=owner, check=True)
|
|
assert all(digest(owner / name) == value for name, value in after.items())
|
|
receipt = {'repo': repo, 'base_commit': head, 'patch_sha256': 'sha256:' + patch_hash,
|
|
'integrated_at': datetime.now(timezone.utc).isoformat(),
|
|
'files_sha256': {name: 'sha256:' + value for name, value in after.items()},
|
|
'source_integrated': True, 'committed': False, 'published': False,
|
|
'native_accepted': False}
|
|
(folder / 'canonical-integration.json').write_text(json.dumps(receipt, indent=2) + '\n')
|
|
print(f'{repo}: {len(after)} reviewed source files integrated')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|