54 lines
2.6 KiB
Python
54 lines
2.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Publish the reviewed local agent source into the controller static release."""
|
|
import ast
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import re
|
|
|
|
|
|
def manifest_bytes(agent, updater, installer):
|
|
"""Return the deterministic bytes signed by the offline release signer."""
|
|
# Inspect source without importing or executing release code.
|
|
versions = [node.value.value for node in ast.parse(agent).body
|
|
if isinstance(node, ast.Assign) and any(isinstance(name, ast.Name) and name.id == "VERSION" for name in node.targets)
|
|
and isinstance(node.value, ast.Constant) and isinstance(node.value.value, str)]
|
|
if len(versions) != 1 or not re.fullmatch(r"(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", versions[0]):
|
|
raise ValueError("Agent source must declare exactly one literal semantic VERSION")
|
|
compile(agent, "ec_agent.py", "exec")
|
|
compile(updater, "ec_agent_update.py", "exec")
|
|
manifest = {"version": versions[0], "protocolVersion": 1, "platform": "debian-amd64",
|
|
"sha256": hashlib.sha256(agent).hexdigest(), "updaterProtocolVersion": 2,
|
|
"updaterSha256": hashlib.sha256(updater).hexdigest(),
|
|
"installerSha256": hashlib.sha256(installer).hexdigest()}
|
|
return (json.dumps(manifest, indent=2) + "\n").encode("utf-8")
|
|
|
|
|
|
def package(source, target):
|
|
"""Read version metadata without importing or executing release code."""
|
|
source, target = Path(source), Path(target)
|
|
agent = (source / "ec_agent.py").read_bytes()
|
|
updater = (source / "ec_agent_update.py").read_bytes()
|
|
installer = (source / "install.sh").read_bytes()
|
|
manifest = manifest_bytes(agent, updater, installer)
|
|
target.mkdir(parents=True, exist_ok=True)
|
|
try:
|
|
previous_manifest = (target / "manifest.json").read_bytes()
|
|
except FileNotFoundError:
|
|
previous_manifest = None
|
|
if previous_manifest != manifest:
|
|
# Builds never sign. Keep an offline signature only across identical
|
|
# rebuilds; changed releases remain unsigned until reviewed and signed.
|
|
(target / "manifest.json.sig").unlink(missing_ok=True)
|
|
(target / "ec-agent.py").write_bytes(agent)
|
|
(target / "ec-agent-update.py").write_bytes(updater)
|
|
(target / "install.sh").write_bytes(installer)
|
|
temporary_manifest = target / ".manifest.json.tmp"
|
|
temporary_manifest.write_bytes(manifest)
|
|
temporary_manifest.replace(target / "manifest.json")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
source = Path(__file__).resolve().parent
|
|
package(source, source.parent / "static" / "agent")
|