69 lines
2.4 KiB
Python
69 lines
2.4 KiB
Python
#!/usr/bin/env python3
|
||
"""校验已构建镜像的 BUILDINFO 供应链清单（事后 lockfile 检查）。
|
||
|
||
事前 apt/pip 精确 lockfile 无法在本轨生成：apt 版本在构建
|
||
宿主上解析、pip 版本在客机里解析，没有构建宿主就编不出
|
||
版本号——本脚本绝不编造。构建时 build.sh 已从客机读回
|
||
dpkg + pip freeze 写进 BUILDINFO.versions（事后 lockfile），
|
||
本脚本校验它：versions 非空、tag 与预期一致、可选的冻结
|
||
清单（--frozen JSON，形如 {"dpkg": ["pkg version", ...]}）
|
||
逐项比对，漂移即退出非 0。
|
||
|
||
用法：
|
||
python3 check_lockfile.py out/BUILDINFO.json [--tag TAG]
|
||
[--frozen frozen.json]
|
||
"""
|
||
import json
|
||
import sys
|
||
|
||
|
||
def main(argv):
|
||
if len(argv) < 2:
|
||
print("用法：check_lockfile.py BUILDINFO.json [--tag TAG] "
|
||
"[--frozen frozen.json]", file=sys.stderr)
|
||
return 2
|
||
path = argv[1]
|
||
tag = None
|
||
frozen_path = None
|
||
i = 2
|
||
while i < len(argv):
|
||
if argv[i] == "--tag" and i + 1 < len(argv):
|
||
tag = argv[i + 1]
|
||
i += 2
|
||
elif argv[i] == "--frozen" and i + 1 < len(argv):
|
||
frozen_path = argv[i + 1]
|
||
i += 2
|
||
else:
|
||
print("未知参数：%s" % argv[i], file=sys.stderr)
|
||
return 2
|
||
with open(path) as fh:
|
||
data = json.load(fh)
|
||
if tag is not None and data.get("tag") != tag:
|
||
print("tag 不一致：%s != %s" % (data.get("tag"), tag),
|
||
file=sys.stderr)
|
||
return 1
|
||
versions = data.get("versions") or {}
|
||
if not versions.get("dpkg") or not versions.get("pip"):
|
||
print("BUILDINFO.versions.dpkg/pip 为空，供应链清单缺失",
|
||
file=sys.stderr)
|
||
return 1
|
||
if frozen_path:
|
||
with open(frozen_path) as fh:
|
||
frozen = json.load(fh)
|
||
for kind in ("dpkg", "pip"):
|
||
want = set(frozen.get(kind) or [])
|
||
got = set(versions.get(kind) or [])
|
||
missing = want - got
|
||
if missing:
|
||
print("%s 漂移：冻结清单里有、构建产物里无：%s"
|
||
% (kind, sorted(missing)), file=sys.stderr)
|
||
return 1
|
||
print("lockfile 校验通过：tag=%s dpkg=%d pip=%d"
|
||
% (data.get("tag"), len(versions["dpkg"]),
|
||
len(versions["pip"])))
|
||
return 0
|
||
|
||
|
||
if __name__ == "__main__":
|
||
raise SystemExit(main(sys.argv))
|