wt
51a414d386
Changes: Propose the pinned XMPP library decision and add an isolated browser-built selection spike combining reviewed public SASL, SHA-512 and parser seams. Exercise TLS/xmpp handshake, strongest compatible non-PLUS authentication, rejected unsafe paths and extension mappings; document duplicate-body export projection and remaining limits. Preserve dependency notices, evidence and QA handoff. Validation: Clean-cache pinned npm ci succeeded; npm test passed 112 checks; check-dependencies.py verified 51 locked entries, 26 installed packages and 340 unchanged vendor files; make check passed 72 tooling tests. No actual browser runtime, independent full XMPP server/client or production encryption/release readiness claim. Task: S00-003 Agent: auto-protocol-f474114f0168 Role: protocol Action: claim Status: review Task title: Проверить XMPP WSS/auth библиотеку
56 lines
3.0 KiB
Python
56 lines
3.0 KiB
Python
"""Check installed locked graph, notices, browser backend and reviewed source reuse."""
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
|
|
root = Path(__file__).resolve().parent
|
|
lock = json.loads((root / 'package-lock.json').read_text())['packages']
|
|
manifest = json.loads((root / 'package.json').read_text())
|
|
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
|
|
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
|
|
for section in ('dependencies', 'devDependencies'):
|
|
for name, version in manifest[section].items():
|
|
assert lock['node_modules/' + name]['version'] == version
|
|
installed = 0
|
|
for path, entry in lock.items():
|
|
if not path:
|
|
continue
|
|
name = path.split('node_modules/')[-1]
|
|
assert entry['resolved'].startswith('https://registry.npmjs.org/')
|
|
assert entry['integrity'].startswith('sha512-')
|
|
assert f"| {name} | {entry['version']} | {entry['license']} |" in inventory
|
|
package = root / path
|
|
if not package.exists():
|
|
assert entry.get('optional'), name
|
|
continue
|
|
meta = json.loads((package / 'package.json').read_text())
|
|
assert meta['version'] == entry['version']
|
|
assert meta['license'] == entry['license']
|
|
licenses = [f for f in package.iterdir() if f.is_file() and
|
|
('license' in f.name.lower() or f.name.lower().startswith(('notice', 'copying')))]
|
|
if name == 'saxes':
|
|
licenses = [root / 'licenses/saxes-6.0.0-LICENSE']
|
|
if not licenses and name.startswith('@rolldown/binding-'):
|
|
licenses = [root / 'node_modules/rolldown/LICENSE', root / 'node_modules/rolldown/THIRD-PARTY-LICENSE']
|
|
assert licenses, name
|
|
for file in licenses:
|
|
assert file.read_text().rstrip() in notices, file
|
|
installed += 1
|
|
# Independently installed, reviewed locked vendor graph, read only.
|
|
original = root.parent / 'environment-access/node_modules/stanza'
|
|
current = root / 'node_modules/stanza'
|
|
files = {f.relative_to(current) for f in current.rglob('*') if f.is_file()}
|
|
assert files == {f.relative_to(original) for f in original.rglob('*') if f.is_file()}
|
|
for file in files:
|
|
assert (current / file).read_bytes() == (original / file).read_bytes(), file
|
|
for local, reviewed in [('bounded-ingress.mjs', 'parser-validation/bounded-ingress.mjs'),
|
|
('sha512-mechanism.mjs', 'sha512-validation/sha512-mechanism.mjs'),
|
|
('licenses/saxes-6.0.0-LICENSE', 'parser-validation/licenses/saxes-6.0.0-LICENSE')]:
|
|
assert (root / local).read_bytes() == (root.parent / reviewed).read_bytes(), local
|
|
modules = json.loads((root / 'dist/modules.json').read_text())
|
|
assert any(x.endswith('/stanza/platform/browser/crypto/Hmac.js') for x in modules)
|
|
assert not any('/platform/node/' in x or x.startswith('node:') or 'browser-external' in x for x in modules)
|
|
print(f'{len(lock)-1} locked / {installed} installed packages; notices verified; {len(files)} unchanged Stanza files; reviewed parser/alias reused; browser backend')
|
|
for file in ['package-lock.json', 'validated-sasl.mjs', 'dist/browser.mjs']:
|
|
print(file, hashlib.sha256((root / file).read_bytes()).hexdigest())
|