65 lines
3.4 KiB
Python
65 lines
3.4 KiB
Python
|
"""Read-only verification of this exact private runtime's pinned distributions.
|
||
|
|
|
||
|
|
Installed RECORD checks detect inconsistent installation; only the PDFium wheel
|
||
|
|
comparison below supplies independent pinned artifact provenance. Neither is an
|
||
|
|
independent attestation of all base package wheels beyond prior provisioning.
|
||
|
|
"""
|
||
|
|
import base64
|
||
|
|
import hashlib
|
||
|
|
import importlib.metadata
|
||
|
|
import re
|
||
|
|
import sys
|
||
|
|
import zipfile
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
root = Path(__file__).resolve().parent.parent
|
||
|
|
runtime = root / '.runtime/windows/python'
|
||
|
|
site = runtime / 'Lib/site-packages'
|
||
|
|
if Path(sys.executable).resolve().parent != runtime.resolve():
|
||
|
|
raise SystemExit('Use the exact private Windows Python runtime')
|
||
|
|
|
||
|
|
names = []
|
||
|
|
checked = 0
|
||
|
|
def file_hash(path):
|
||
|
|
digest = hashlib.sha256()
|
||
|
|
with path.open('rb') as file:
|
||
|
|
for chunk in iter(lambda: file.read(1048576), b''): digest.update(chunk)
|
||
|
|
return digest.digest()
|
||
|
|
|
||
|
|
for filename in ('requirements.lock.txt', 'requirements-macros.lock.txt', 'requirements-pdf.lock.txt'):
|
||
|
|
for line in (root / 'apps/inspector' / filename).read_text(encoding='utf-8').splitlines():
|
||
|
|
if not line or line.startswith('#'): continue
|
||
|
|
match = re.match(r'^([A-Za-z0-9_.-]+)==([^\s]+)\s+--hash=sha256:', line)
|
||
|
|
if not match: raise SystemExit('Runtime dependency lock rejected')
|
||
|
|
name, version = match.groups()
|
||
|
|
distribution = importlib.metadata.distribution(name)
|
||
|
|
if distribution.version != version: raise SystemExit('Runtime dependency version mismatch')
|
||
|
|
names.append(name)
|
||
|
|
for entry in distribution.files or []:
|
||
|
|
if entry.hash is None: continue
|
||
|
|
path = distribution.locate_file(entry).resolve()
|
||
|
|
if not path.is_relative_to(runtime.resolve()) or not path.is_file(): raise SystemExit('Runtime dependency file missing')
|
||
|
|
if entry.hash.mode != 'sha256': raise SystemExit('Runtime dependency hash algorithm rejected')
|
||
|
|
actual = base64.urlsafe_b64encode(file_hash(path)).decode().rstrip('=')
|
||
|
|
if actual != entry.hash.value: raise SystemExit('Runtime dependency file integrity mismatch')
|
||
|
|
checked += 1
|
||
|
|
|
||
|
|
wheel = root / '.runtime/windows/pypdfium2-5.14.0-py3-none-win_amd64.whl'
|
||
|
|
expected = '149fd5c6397b8df8bf7911a93506eff0be874f877afe7ac936cf5d37d21a6a06'
|
||
|
|
if not wheel.is_file() or hashlib.sha256(wheel.read_bytes()).hexdigest() != expected:
|
||
|
|
raise SystemExit('Pinned PDFium wheel verification failed')
|
||
|
|
pdf_files = 0
|
||
|
|
with zipfile.ZipFile(wheel) as archive:
|
||
|
|
for entry in archive.infolist():
|
||
|
|
if entry.is_dir() or entry.filename.endswith('.dist-info/RECORD'): continue
|
||
|
|
target = (site / entry.filename).resolve()
|
||
|
|
if not target.is_relative_to(site.resolve()) or not target.is_file() or target.read_bytes() != archive.read(entry):
|
||
|
|
raise SystemExit('Installed PDFium differs from pinned wheel')
|
||
|
|
pdf_files += 1
|
||
|
|
import pypdfium2
|
||
|
|
if pypdfium2.PYPDFIUM_INFO.api_tag != (5, 14, 0) or pypdfium2.PDFIUM_INFO.flags:
|
||
|
|
raise SystemExit('PDFium feature manifest rejected')
|
||
|
|
licenses = site / 'pypdfium2-5.14.0.dist-info/licenses'
|
||
|
|
if not (licenses / 'LICENSES/Apache-2.0.txt').is_file() or not (licenses / 'LICENSES/BSD-3-Clause.txt').is_file() or not any((licenses / 'data/windows_x64/BUILD_LICENSES').glob('*')):
|
||
|
|
raise SystemExit('PDFium license notices missing')
|
||
|
|
print(f'Private runtime verified: {len(names)} pinned distributions, {checked} RECORD hashes, {pdf_files} pinned PDFium wheel files; license notices retained.')
|