57 lines
2.2 KiB
Python
57 lines
2.2 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""WAPT-native source preparation entry point (no build/sign/upload)."""
|
|
from pathlib import Path
|
|
import importlib.util
|
|
import os
|
|
import sys
|
|
|
|
|
|
def _source_directory():
|
|
"""Find package root and return its path relative to the current directory."""
|
|
source = Path(os.path.relpath(Path(__file__).resolve().parent, Path.cwd()))
|
|
if not (source / 'WAPT' / 'control').is_file():
|
|
raise RuntimeError('update_package.py must be inside a WAPT package source directory.')
|
|
return source
|
|
|
|
|
|
def _load_tool(source, name):
|
|
path = source / 'tools' / (name + '.py')
|
|
spec = importlib.util.spec_from_file_location('comi_audit_secu_' + name, str(path))
|
|
if spec is None or spec.loader is None:
|
|
raise RuntimeError('Cannot load package tool: %s' % path)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def update_package():
|
|
"""Prepare and verify pinned assets; WAPT Console still builds and signs."""
|
|
source = _source_directory()
|
|
vendor_tool = _load_tool(source, 'vendor_assets')
|
|
archive = os.environ.get('HARDENINGKITTY_ARCHIVE')
|
|
if archive:
|
|
archive_path = Path(archive)
|
|
data = archive_path.read_bytes()
|
|
if len(data) > vendor_tool.MAX_ARCHIVE_BYTES:
|
|
raise RuntimeError('Offline HardeningKitty archive exceeds size limit.')
|
|
expected = os.environ.get('HARDENINGKITTY_ARCHIVE_SHA256')
|
|
if not expected:
|
|
raise RuntimeError('HARDENINGKITTY_ARCHIVE_SHA256 is required for offline preparation.')
|
|
if vendor_tool.sha256(data).lower() != expected.lower():
|
|
raise RuntimeError('Offline HardeningKitty archive checksum mismatch.')
|
|
else:
|
|
data = vendor_tool._download_snapshot()
|
|
vendor_tool.vendor_from_archive(data, source / 'vendor')
|
|
verifier = _load_tool(source, 'package_verify')
|
|
verifier.write_source_manifest(source)
|
|
verifier.verify_source(source)
|
|
print('HardeningKitty sources are prepared and verified. No WAPT build, signature or upload was performed.')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
update_package()
|
|
except Exception as exc:
|
|
print('ERROR: %s' % exc, file=sys.stderr)
|
|
raise
|