wt
2af4f143d8
Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks. Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed. Task: S00-026 Agent: auto-ci-cd-4255c34da227 Role: ci-cd Action: claim Status: review Task title: Provide approved access to the pinned Linux experiment artifacts
83 lines
4.1 KiB
Python
83 lines
4.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Repeat the bounded Linux x64 environment probe; never install system tools."""
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import platform
|
|
import shutil
|
|
import subprocess
|
|
import tarfile
|
|
import tempfile
|
|
|
|
HERE = Path(__file__).resolve().parent
|
|
PARENT = HERE.parent
|
|
ARCHIVE = 'node-v24.21.0-linux-x64.tar.xz'
|
|
ORIGIN = 'https://nodejs.org/dist/v24.21.0/'
|
|
|
|
|
|
def run(argv, **kwargs):
|
|
return subprocess.check_output(argv, text=True, **kwargs).strip()
|
|
|
|
|
|
def digest(path):
|
|
return hashlib.sha256(path.read_bytes()).hexdigest()
|
|
|
|
|
|
def main():
|
|
if (platform.system(), platform.machine()) != ('Linux', 'x86_64'):
|
|
raise SystemExit('This probe requires Linux x86_64; no alternate runtime is selected.')
|
|
work = Path(tempfile.mkdtemp(prefix='luma-S00-026-'))
|
|
for name in ('SHASUMS256.txt', ARCHIVE):
|
|
subprocess.run(['curl', '--fail', '--silent', '--show-error',
|
|
'--proto', '=https', '--connect-timeout', '10',
|
|
'--max-time', '60', ORIGIN + name, '-o', str(work / name)], check=True)
|
|
shutil.copyfile(work / 'SHASUMS256.txt', HERE / 'SHASUMS256.txt')
|
|
entries = dict(line.split()[::-1] for line in (work / 'SHASUMS256.txt').read_text().splitlines())
|
|
archive_hash = digest(work / ARCHIVE)
|
|
if entries.get(ARCHIVE) != archive_hash:
|
|
raise SystemExit('Vendor archive checksum mismatch; extraction refused.')
|
|
# Python data filter prevents traversal and unsafe special-file extraction.
|
|
with tarfile.open(work / ARCHIVE) as archive:
|
|
archive.extractall(work, filter='data')
|
|
runtime = work / 'node-v24.21.0-linux-x64' / 'bin'
|
|
env = dict(os.environ, PATH=str(runtime) + os.pathsep + os.environ.get('PATH', ''))
|
|
versions = {tool: run([str(runtime / tool), '--version'], env=env) for tool in ('node', 'npm')}
|
|
if versions != {'node': 'v24.21.0', 'npm': '11.19.0'}:
|
|
raise SystemExit('Pinned runtime versions do not match.')
|
|
for name in ('package.json', 'package-lock.json'):
|
|
shutil.copyfile(PARENT / name, HERE / name)
|
|
lock = json.loads((HERE / 'package-lock.json').read_text())
|
|
for name, package in lock['packages'].items():
|
|
if name and (not package['resolved'].startswith('https://registry.npmjs.org/')
|
|
or not package['integrity'].startswith('sha512-')):
|
|
raise SystemExit('Locked dependency lacks required HTTPS/SHA512 integrity.')
|
|
subprocess.run([str(runtime / 'npm'), 'ci', '--ignore-scripts', '--no-audit', '--no-fund',
|
|
'--strict-ssl=true', '--engine-strict=true',
|
|
'--registry=https://registry.npmjs.org/', '--fetch-retries=0',
|
|
'--fetch-timeout=15000', '--cache', str(work / 'npm-cache')],
|
|
cwd=HERE, env=env, check=True)
|
|
hashes = {}
|
|
for name in ('package.json', 'package-lock.json'):
|
|
if (PARENT / name).read_bytes() != (HERE / name).read_bytes():
|
|
raise SystemExit('Copied parent manifest/lock changed.')
|
|
hashes[name] = digest(HERE / name)
|
|
for name, package in lock['packages'].items():
|
|
if name:
|
|
installed = json.loads((HERE / name / 'package.json').read_text())
|
|
if installed['version'] != package['version']:
|
|
raise SystemExit('Installed version differs from parent lock: ' + name)
|
|
stanza = run([str(runtime / 'node'), '--input-type=module', '-e',
|
|
"import {createClient} from 'stanza'; if(typeof createClient !== 'function') process.exit(1); console.log('Stanza createClient import passed')"], cwd=HERE, env=env)
|
|
report = {'platform': 'Linux x86_64', 'origin': ORIGIN, 'archive': ARCHIVE,
|
|
'archive_sha256': archive_hash, 'versions': versions, 'runtime_bin': str(runtime),
|
|
'cache': str(work / 'npm-cache'), 'parent_sha256': hashes,
|
|
'locked_packages': len(lock['packages']) - 1, 'stanza': '12.22.1',
|
|
'import_check': stanza, 'checksum_method': 'Vendor HTTPS SHASUMS256.txt; no detached signature check'}
|
|
(HERE / 'result.json').write_text(json.dumps(report, indent=2) + '\n')
|
|
print(json.dumps(report, indent=2))
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|