USB-AIO für automatische Geräteprüfung

scripts/release-manifest.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Source fingerprint and artifact verification; never touches USB devices."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import tomllib
+
+ROOT = Path(__file__).resolve().parents[1]
+COMPONENTS = {'gui': 'intake-gui', 'scanner': 'pc-intake', 'controller': 'intake-controller'}
+
+def digest(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+def source_id():
+    paths = []
+    for component in COMPONENTS:
+        base = ROOT / component
+        paths.extend((base / 'src').rglob('*.rs'))
+        paths.extend(p for p in [base / 'Cargo.toml', base / 'Cargo.lock', base / 'build.rs'] if p.exists())
+    for folder in ['scripts', 'live']:
+        paths.extend(p for p in (ROOT / folder).iterdir() if p.is_file())
+    h = hashlib.sha256()
+    for path in sorted(paths):
+        h.update(str(path.relative_to(ROOT)).encode() + b'\0')
+        h.update(path.read_bytes())
+    return 'csr-' + h.hexdigest()[:20]
+
+def create(path):
+    binaries = {}
+    for component, name in COMPONENTS.items():
+        package = tomllib.loads((ROOT / component / 'Cargo.toml').read_text())['package']
+        binary = ROOT / component / 'target/release' / name
+        binaries[name] = {'version': package['version'], 'sha256': digest(binary)}
+    build_id = source_id()
+    version = subprocess.check_output([ROOT / 'gui/target/release/intake-gui', '--version'], text=True).strip()
+    if build_id not in version:
+        raise ValueError('GUI source fingerprint does not match current sources; rebuild release')
+    manifest = {'schema_version': 1, 'build_id': build_id, 'rustc': subprocess.check_output(['rustc', '--version'], text=True).strip(), 'binaries': binaries}
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(manifest, indent=2) + '\n')
+
+def verify(profile):
+    root = profile / 'airootfs'
+    manifest = json.loads((root / 'etc/csr-intake/release.json').read_text())
+    for name, spec in manifest['binaries'].items():
+        binary = root / 'usr/local/bin' / name
+        if digest(binary) != spec['sha256']:
+            raise ValueError(f'Binary hash mismatch: {name}')
+        if not binary.stat().st_mode & 0o111:
+            raise ValueError(f'Binary is not executable: {name}')
+    version = subprocess.check_output([root / 'usr/local/bin/intake-gui', '--version'], text=True)
+    if manifest['build_id'] not in version:
+        raise ValueError('GUI build ID differs from release manifest')
+    required = ['networkmanager', 'curl', 'ca-certificates', 'python', 'usbutils', 'smartmontools', 'alsa-utils', 'ffmpeg', 'stress-ng', 'xdg-utils', 'firefox']
+    packages = (profile / 'packages.x86_64').read_text().splitlines()
+    for package in required:
+        if package not in packages:
+            raise ValueError(f'Missing live package: {package}')
+    for file in ['usr/local/bin/intake-login', 'usr/local/bin/intake-prepare', 'etc/systemd/system/getty@tty1.service.d/autologin.conf', 'etc/systemd/system/multi-user.target.wants/NetworkManager.service']:
+        p = root / file
+        if not p.exists() and not p.is_symlink():
+            raise ValueError(f'Missing live startup file: {file}')
+    print(f"Profile verified: {manifest['build_id']}")
+
+def main():
+    parser = argparse.ArgumentParser()
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument('--source-id', action='store_true')
+    group.add_argument('--create', type=Path)
+    group.add_argument('--verify-profile', type=Path)
+    args = parser.parse_args()
+    if args.source_id: print(source_id())
+    elif args.create: create(args.create)
+    else: verify(args.verify_profile)
+
+if __name__ == '__main__': main()