28 lines
1.7 KiB
Python
28 lines
1.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Apply private OOM deltas to exact reviewed CORE trees; no build/runtime."""
|
|
import argparse,hashlib,json,os,pathlib,shutil,subprocess
|
|
P=pathlib.Path;H=P(__file__).resolve().parent
|
|
|
|
def manifest(root):
|
|
result={}
|
|
for p in sorted(root.rglob('*')):
|
|
if p.is_symlink():raise ValueError('symlink source')
|
|
if p.is_file():result[str(p.relative_to(root))]={'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'mode':oct(p.stat().st_mode&0o777)}
|
|
return result
|
|
|
|
def main():
|
|
ap=argparse.ArgumentParser();ap.add_argument('--core',type=P,required=True);ap.add_argument('--destination',type=P,required=True);a=ap.parse_args()
|
|
d=a.destination.absolute();assert d.is_relative_to(P('/var/tmp')) and d!=P('/var/tmp') and d.resolve()==d and not d.exists()
|
|
os.umask(0o077);d.mkdir(mode=0o700);p=json.loads((H/'provenance.json').read_text());receipt={}
|
|
for c,e in p['components'].items():
|
|
assert manifest(a.core/c)==e['parent_files'],c+' exact reviewed parent mismatch'
|
|
patch=H/e['patch'];assert hashlib.sha256(patch.read_bytes()).hexdigest()==e['patch_sha256']
|
|
dst=d/c;shutil.copytree(a.core/c,dst)
|
|
env=dict(os.environ,GIT_CEILING_DIRECTORIES=str(d))
|
|
subprocess.run(['git','apply','--check',str(patch)],cwd=dst,env=env,check=True)
|
|
subprocess.run(['git','apply',str(patch)],cwd=dst,env=env,check=True)
|
|
for r in e['changed_files']:(dst/r).chmod(int(e['files'][r]['mode'],8))
|
|
assert manifest(dst)==e['files'],c+' variant mismatch'
|
|
receipt[c]={'forward_apply':True,'manifest_sha256':hashlib.sha256(json.dumps(e['files'],sort_keys=True).encode()).hexdigest()}
|
|
(d/'assembly-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps(receipt,indent=2))
|
|
if __name__=='__main__':main()
|