desirecore/agent-desirecore
2
0
Fork 0
mirror of https://git.openapi.site/https://github.com/desirecore/agent-desirecore.git synced 2026-09-05 17:03:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: 增加求解器验证书 Web (#7)

Browse Source 
Co-authored-by: yige <yige@yigedeMacBook-Neo.local>
This commit is contained in:
yi-ge
2026-08-30 11:02:51 -04:00
committed by GitHub
parent 27a6934c63
commit af338dc13b
20 changed files with 3777 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
web/solver-report/scripts/verify-static-release.py Normal file
View File

@@ -0,0 +1,64 @@
#!/usr/bin/env python3
import hashlib
import json
import pathlib
import sys
root = pathlib.Path(sys.argv[1]).resolve()
integrity = json.loads((root / "integrity.json").read_text(encoding="utf-8"))
failures = []
for entry in integrity["entries"]:
raw_path = entry.get("path")
if (
not isinstance(raw_path, str)
or not raw_path
or "//" in raw_path
or "\\" in raw_path
or "%" in raw_path
or "?" in raw_path
or "#" in raw_path
):
failures.append({"path": str(raw_path), "issue": "unsafe-path"})
continue
relative_path = pathlib.PurePosixPath(raw_path)
if relative_path.is_absolute() or any(part in ("", ".", "..") for part in relative_path.parts):
failures.append({"path": raw_path, "issue": "unsafe-path"})
continue
path = (root / pathlib.Path(*relative_path.parts)).resolve()
if path == root or root not in path.parents:
failures.append({"path": raw_path, "issue": "path-escape"})
continue
if not path.is_file():
failures.append({"path": raw_path, "issue": "missing"})
continue
data = path.read_bytes()
digest = hashlib.sha256(data).hexdigest()
if len(data) != entry["bytes"] or digest != entry["sha256"]:
failures.append({"path": raw_path, "issue": "mismatch"})
manifest = json.loads((root / "data" / "manifest.json").read_text(encoding="utf-8"))
build = json.loads((root / "build.json").read_text(encoding="utf-8"))
if build.get("gates", {}).get("publicReleasePrivacy") != "pass":
failures.append({"path": "build.json", "issue": "public-release-privacy-gate"})
if build.get("publicReleaseAttestationSha256") != manifest.get("publicReleaseAttestationSha256"):
failures.append({"path": "build.json", "issue": "public-release-attestation-mismatch"})
if (
build.get("buildId") != manifest.get("buildId")
or build.get("contentRootSha256") != manifest.get("contentRootSha256")
or integrity.get("contentRootSha256") != manifest.get("contentRootSha256")
or build.get("publicEvidenceRoots") != manifest.get("publicEvidenceRoots")
or build.get("counts") != manifest.get("counts")
or build.get("integrityEntries") != len(integrity.get("entries", []))
or not any(entry.get("path") == "build.json" for entry in integrity.get("entries", []))
):
failures.append({"path": "build.json", "issue": "build-manifest-integrity-projection"})
result = {
"buildId": manifest["buildId"],
"contentRootSha256": manifest["contentRootSha256"],
"chapters": len(manifest["chapters"]),
"integrityEntries": len(integrity["entries"]),
"failures": failures,
"passed": not failures,
}
print(json.dumps(result, ensure_ascii=False))
raise SystemExit(0 if result["passed"] else 1)