74 lines
2.2 KiB
Python
Executable File
74 lines
2.2 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Verify a JWeBot extension artifact without extracting it."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path[:0] = [
|
|
str(ROOT / "packages" / "jwebot-sdk" / "src"),
|
|
str(ROOT / "packages" / "jwebot-kernel" / "src"),
|
|
]
|
|
|
|
from jwebot_kernel import ( # noqa: E402
|
|
ReleaseError,
|
|
load_release_record,
|
|
verify_release,
|
|
verify_release_signature,
|
|
)
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("artifact", type=Path)
|
|
parser.add_argument("release", type=Path)
|
|
parser.add_argument("--signature", type=Path)
|
|
parser.add_argument("--allowed-signers", type=Path)
|
|
parser.add_argument("--publisher")
|
|
args = parser.parse_args()
|
|
if (args.signature is None) != (args.allowed_signers is None):
|
|
parser.error("--signature and --allowed-signers must be provided together")
|
|
if args.publisher is not None and args.signature is None:
|
|
parser.error("--publisher requires --signature and --allowed-signers")
|
|
try:
|
|
record = load_release_record(args.release)
|
|
verify_release(args.artifact, record)
|
|
signature = None
|
|
if args.signature is not None:
|
|
signature = verify_release_signature(
|
|
args.release,
|
|
args.signature,
|
|
args.allowed_signers,
|
|
expected_publisher=args.publisher,
|
|
)
|
|
except ReleaseError as error:
|
|
parser.error(str(error))
|
|
print(
|
|
json.dumps(
|
|
{
|
|
"valid": True,
|
|
"plugin_id": record.plugin_id,
|
|
"author": record.author,
|
|
"plugin_version": record.plugin_version,
|
|
"source_digest": record.source_digest,
|
|
"artifact_sha256": record.artifact_sha256,
|
|
"signature_valid": signature is not None,
|
|
"publisher": (
|
|
signature.publisher if signature is not None else None
|
|
),
|
|
},
|
|
ensure_ascii=False,
|
|
sort_keys=True,
|
|
)
|
|
)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|