the-custodian/docs/changes/netkingdom-target-2026-10-17/native-runtime-install-review-r2/verify-installed.py
codex c7bd0a17dd
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
CI Smoke / container-smoke (push) Waiting to run
Reject generated-only commits / generated-commit-guard (push) Waiting to run
docs: preserve reviewed NetKingdom session artifacts
2026-11-01 23:28:44 +01:00

29 lines
1.9 KiB
Python

"""Read-only verification of the approved R2 partial install; never launches it."""
from pathlib import Path
import hashlib
import json
import shlex
import subprocess
HERE = Path(__file__).resolve().parent
R2 = HERE.parent / 'native-runtime-install-r2'
reader = (R2 / 'runtime.py').read_text()
assert hashlib.sha256(reader.encode()).hexdigest() == '19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412'
code = reader + '''
import pwd
digest='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
store=Path('/home/tegwick/.helixforge-factory/runtimes');s=store.lstat()
assert os.getuid()==1000 and os.getgid()==1000 and pwd.getpwuid(1000).pw_name=='tegwick'
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and s.st_gid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_dev==2049 and s.st_ino==4751222
destination=store/digest
actual=runtime_digest(destination)
stage=Path('/home/tegwick/.helixforge-factory/runtime-install-f599-r2-20261017')
assert actual==digest and not stage.exists() and not stage.is_symlink()
print(json.dumps({'status':'partial_install_verified_read_only','runtime_sha256':actual,'installed_complete_digest_verified':True,'owned_stage_absent':True,'store_uid':s.st_uid,'store_gid':s.st_gid,'store_mode':oct(stat.S_IMODE(s.st_mode)),'runtime_launched':False,'private_configuration_read':False,'profile_or_queue_or_owner_state_changed':False,'native_launcher_acceptance':'unverified_after_failed_R2','model_calls':0}))
'''
result = subprocess.run(['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=15', 'railiance01',
'/usr/bin/python3 -I -B -c ' + shlex.quote(code)], capture_output=True, timeout=120)
assert result.returncode == 0, 'read-only verification failed; raw diagnostics suppressed'
value = json.loads(result.stdout)
(HERE / 'installed-partial-verification.json').write_text(json.dumps(value, indent=2) + '\n')
print(json.dumps(value))