79 lines
3.6 KiB
Python
79 lines
3.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Source fingerprint and artifact verification; never touches USB devices."""
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
import tomllib
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
COMPONENTS = {'gui': 'intake-gui', 'scanner': 'pc-intake', 'controller': 'intake-controller'}
|
|
|
|
def digest(path):
|
|
return hashlib.sha256(path.read_bytes()).hexdigest()
|
|
|
|
def source_id():
|
|
paths = []
|
|
for component in COMPONENTS:
|
|
base = ROOT / component
|
|
paths.extend((base / 'src').rglob('*.rs'))
|
|
paths.extend(p for p in [base / 'Cargo.toml', base / 'Cargo.lock', base / 'build.rs'] if p.exists())
|
|
for folder in ['scripts', 'live']:
|
|
paths.extend(p for p in (ROOT / folder).iterdir() if p.is_file())
|
|
h = hashlib.sha256()
|
|
for path in sorted(paths):
|
|
h.update(str(path.relative_to(ROOT)).encode() + b'\0')
|
|
h.update(path.read_bytes())
|
|
return 'csr-' + h.hexdigest()[:20]
|
|
|
|
def create(path):
|
|
binaries = {}
|
|
for component, name in COMPONENTS.items():
|
|
package = tomllib.loads((ROOT / component / 'Cargo.toml').read_text())['package']
|
|
binary = ROOT / component / 'target/release' / name
|
|
binaries[name] = {'version': package['version'], 'sha256': digest(binary)}
|
|
build_id = source_id()
|
|
version = subprocess.check_output([ROOT / 'gui/target/release/intake-gui', '--version'], text=True).strip()
|
|
if build_id not in version:
|
|
raise ValueError('GUI source fingerprint does not match current sources; rebuild release')
|
|
manifest = {'schema_version': 1, 'build_id': build_id, 'rustc': subprocess.check_output(['rustc', '--version'], text=True).strip(), 'binaries': binaries}
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(json.dumps(manifest, indent=2) + '\n')
|
|
|
|
def verify(profile):
|
|
root = profile / 'airootfs'
|
|
manifest = json.loads((root / 'etc/csr-intake/release.json').read_text())
|
|
for name, spec in manifest['binaries'].items():
|
|
binary = root / 'usr/local/bin' / name
|
|
if digest(binary) != spec['sha256']:
|
|
raise ValueError(f'Binary hash mismatch: {name}')
|
|
if not binary.stat().st_mode & 0o111:
|
|
raise ValueError(f'Binary is not executable: {name}')
|
|
version = subprocess.check_output([root / 'usr/local/bin/intake-gui', '--version'], text=True)
|
|
if manifest['build_id'] not in version:
|
|
raise ValueError('GUI build ID differs from release manifest')
|
|
required = ['networkmanager', 'curl', 'ca-certificates', 'python', 'usbutils', 'smartmontools', 'alsa-utils', 'ffmpeg', 'stress-ng', 'xdg-utils', 'firefox']
|
|
packages = (profile / 'packages.x86_64').read_text().splitlines()
|
|
for package in required:
|
|
if package not in packages:
|
|
raise ValueError(f'Missing live package: {package}')
|
|
for file in ['usr/local/bin/intake-login', 'usr/local/bin/intake-prepare', 'etc/systemd/system/getty@tty1.service.d/autologin.conf', 'etc/systemd/system/multi-user.target.wants/NetworkManager.service']:
|
|
p = root / file
|
|
if not p.exists() and not p.is_symlink():
|
|
raise ValueError(f'Missing live startup file: {file}')
|
|
print(f"Profile verified: {manifest['build_id']}")
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser()
|
|
group = parser.add_mutually_exclusive_group(required=True)
|
|
group.add_argument('--source-id', action='store_true')
|
|
group.add_argument('--create', type=Path)
|
|
group.add_argument('--verify-profile', type=Path)
|
|
args = parser.parse_args()
|
|
if args.source_id: print(source_id())
|
|
elif args.create: create(args.create)
|
|
else: verify(args.verify_profile)
|
|
|
|
if __name__ == '__main__': main()
|