fix(audit): harden HardeningKitty packaging and reporting

update_package.py

@@ -1,6 +1,56 @@
-def update_package():
-    import runpy
+# -*- coding: utf-8 -*-
+"""WAPT-native source preparation entry point (no build/sign/upload)."""
+from pathlib import Path
+import importlib.util
+import os
+import sys
 
-    script = os.path.join(_source_directory(), 'update_package.py')
-    module = runpy.run_path(script, run_name='wapt_update_package')
-    module['update_package']()
+
+def _source_directory():
+    """Find the package source from this file, independent of the current cwd."""
+    source = Path(__file__).resolve().parent
+    if not (source / 'WAPT' / 'control').is_file():
+        raise RuntimeError('update_package.py must be inside a WAPT package source directory.')
+    return source
+
+
+def _load_tool(source, name):
+    path = source / 'tools' / (name + '.py')
+    spec = importlib.util.spec_from_file_location('comi_audit_secu_' + name, str(path))
+    if spec is None or spec.loader is None:
+        raise RuntimeError('Cannot load package tool: %s' % path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def update_package():
+    """Prepare and verify pinned assets; WAPT Console still builds and signs."""
+    source = _source_directory()
+    vendor_tool = _load_tool(source, 'vendor_assets')
+    archive = os.environ.get('HARDENINGKITTY_ARCHIVE')
+    if archive:
+        archive_path = Path(archive)
+        data = archive_path.read_bytes()
+        if len(data) > vendor_tool.MAX_ARCHIVE_BYTES:
+            raise RuntimeError('Offline HardeningKitty archive exceeds size limit.')
+        expected = os.environ.get('HARDENINGKITTY_ARCHIVE_SHA256')
+        if not expected:
+            raise RuntimeError('HARDENINGKITTY_ARCHIVE_SHA256 is required for offline preparation.')
+        if vendor_tool.sha256(data).lower() != expected.lower():
+            raise RuntimeError('Offline HardeningKitty archive checksum mismatch.')
+    else:
+        data = vendor_tool._download_snapshot()
+    vendor_tool.vendor_from_archive(data, source / 'vendor')
+    verifier = _load_tool(source, 'package_verify')
+    verifier.write_source_manifest(source)
+    verifier.verify_source(source)
+    print('HardeningKitty sources are prepared and verified. No WAPT build, signature or upload was performed.')
+
+
+if __name__ == '__main__':
+    try:
+        update_package()
+    except Exception as exc:
+        print('ERROR: %s' % exc, file=sys.stderr)
+        raise