release: public alpha 0.6.0 baseline

2026-10-15 03:58:31 +08:00
commit d4242ae07c
238 changed files with 37724 additions and 0 deletions
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+"""Verify a JWeBot extension artifact without extracting it."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path[:0] = [
+    str(ROOT / "packages" / "jwebot-sdk" / "src"),
+    str(ROOT / "packages" / "jwebot-kernel" / "src"),
+]
+
+from jwebot_kernel import (  # noqa: E402
+    ReleaseError,
+    load_release_record,
+    verify_release,
+    verify_release_signature,
+)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("artifact", type=Path)
+    parser.add_argument("release", type=Path)
+    parser.add_argument("--signature", type=Path)
+    parser.add_argument("--allowed-signers", type=Path)
+    parser.add_argument("--publisher")
+    args = parser.parse_args()
+    if (args.signature is None) != (args.allowed_signers is None):
+        parser.error("--signature and --allowed-signers must be provided together")
+    if args.publisher is not None and args.signature is None:
+        parser.error("--publisher requires --signature and --allowed-signers")
+    try:
+        record = load_release_record(args.release)
+        verify_release(args.artifact, record)
+        signature = None
+        if args.signature is not None:
+            signature = verify_release_signature(
+                args.release,
+                args.signature,
+                args.allowed_signers,
+                expected_publisher=args.publisher,
+            )
+    except ReleaseError as error:
+        parser.error(str(error))
+    print(
+        json.dumps(
+            {
+                "valid": True,
+                "plugin_id": record.plugin_id,
+                "author": record.author,
+                "plugin_version": record.plugin_version,
+                "source_digest": record.source_digest,
+                "artifact_sha256": record.artifact_sha256,
+                "signature_valid": signature is not None,
+                "publisher": (
+                    signature.publisher if signature is not None else None
+                ),
+            },
+            ensure_ascii=False,
+            sort_keys=True,
+        )
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())