#!/usr/bin/env python3 """Vierzielpakete bauen, entpackt prüfen und vollständige Freigaben validieren.""" import argparse import hashlib import json import os from pathlib import Path import platform import re import shutil import subprocess import sys import tarfile import tempfile import tomllib ROOT = Path(__file__).resolve().parents[2] TARGETS = { 'x86_64-pc-windows-msvc': ('windows-amd64', '.7z'), 'aarch64-apple-darwin': ('macos-arm64', '.tar.gz'), 'x86_64-unknown-linux-gnu': ('linux-amd64', '.tar.gz'), 'aarch64-unknown-linux-gnu': ('linux-arm64', '.tar.gz'), } HOSTS = {('Windows', 'AMD64'): list(TARGETS)[0], ('Darwin', 'arm64'): list(TARGETS)[1], ('Linux', 'x86_64'): list(TARGETS)[2], ('Linux', 'aarch64'): list(TARGETS)[3]} TBL_SHA = '5d25c2f8c95ae535e55a6c84c1ddd0d964358863f4f3c780c50ac4a2eb3594df' def require(condition, message): if not condition: raise ValueError(message) def digest(path): return hashlib.sha256(path.read_bytes()).hexdigest() def run(command, **kwargs): print('+', ' '.join(map(str, command)), flush=True) return subprocess.run(list(map(str, command)), check=True, timeout=3600, **kwargs) def name(version, target): require(re.fullmatch(r'[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?', version), 'Ungültige Paketversion') label, extension = TARGETS[target] return f'terminalbasic-{version}-{label}{extension}' def sevenzip(): tool = shutil.which('7zz') or shutil.which('7z') require(tool, '7-Zip fehlt; Windows erfordert echte .7z-Archive') return tool def programs(target): suffix = '.exe' if target == list(TARGETS)[0] else '' return ['tb' + suffix, 'tbc' + suffix, f'runtimes/{target}/tbrt' + suffix] def files(target): return set(programs(target) + [programs(target)[2] + '.meta', 'LICENSE', 'INSTALL.txt', 'manifest.json']) def unpack(archive, dest, target): """Nur bekannte reguläre Dateien; keine Symlinks, Unterverzeichnisse oder Traversierung.""" if archive.name.endswith('.7z'): listing = subprocess.check_output([sevenzip(), 'l', '-slt', '--', str(archive)], text=True) members = listing.split('----------\n', 1)[-1].strip().split('\n\n') found = set() for member in members: fields = dict(line.split(' = ', 1) for line in member.splitlines() if ' = ' in line) path = fields.get('Path') require(path in files(target) and path not in found, f'Unerlaubter Archiveintrag: {path}') require(fields.get('Folder', '-') == '-' and not fields.get('Symbolic Link') and not fields.get('Hard Link') and not fields.get('Attributes', '').startswith('D'), 'Archivlink/-verzeichnis') found.add(path) require(found == files(target), 'Unvollständiges 7z-Archiv') run([sevenzip(), 'x', '-y', '-o' + str(dest), '--', archive], stdout=subprocess.DEVNULL) else: with tarfile.open(archive, 'r:gz') as tar: members = tar.getmembers() require(len(members) == len(files(target)) and {m.name for m in members} == files(target), 'Falscher Archivinhalt') require(all(m.isfile() for m in members), 'Nur reguläre Dateien erlaubt') for member in members: data = tar.extractfile(member).read() path = dest / member.name path.parent.mkdir(parents=True, exist_ok=True) path.write_bytes(data) path.chmod(member.mode & 0o777) require({p.relative_to(dest).as_posix() for p in dest.rglob('*') if p.is_file()} == files(target), 'Falscher entpackter Inhalt') require(all(not p.is_symlink() and (p.is_file() or p.is_dir()) for p in dest.rglob('*')), 'Unerlaubter Dateityp') def verify(archive, target, inspector=None): with tempfile.TemporaryDirectory(prefix='tb-package-') as temp: dest = Path(temp) unpack(archive, dest, target) manifest = json.loads((dest / 'manifest.json').read_text()) require(manifest['target'] == target and archive.name == name(manifest['version'], target), 'Falsches Paketziel/-version') require(set(manifest['files']) == files(target) - {'manifest.json'}, 'Falsches Dateimanifest') for path, sha in manifest['files'].items(): require(digest(dest / path) == sha, f'Beschädigte Datei: {path}') for binary in programs(target): if inspector: run([inspector, '--inspect', dest / binary, target], stdout=subprocess.DEVNULL) if target != list(TARGETS)[0]: require((dest / binary).stat().st_mode & 0o111 == 0o111, 'Executable-Rechte fehlen') metadata = (dest / (programs(target)[2] + '.meta')).read_text() require(f'target={target}\n' in metadata and f'package={manifest["version"]}\n' in metadata, 'Vorlagenversion/-ziel falsch') return manifest def pack(binary_dir, target, output, inspector): version = tomllib.loads((ROOT / 'Cargo.toml').read_text())['workspace']['package']['version'] revision = subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=ROOT, text=True).strip() output.mkdir(parents=True, exist_ok=True) archive = output / name(version, target) require(not archive.exists(), f'Paket existiert bereits: {archive}') with tempfile.TemporaryDirectory(prefix='tb-pack-') as temp: stage = Path(temp) for binary in programs(target): run([inspector, '--inspect', binary_dir / Path(binary).name, target], stdout=subprocess.DEVNULL) (stage / binary).parent.mkdir(parents=True, exist_ok=True) shutil.copyfile(binary_dir / Path(binary).name, stage / binary) (stage / binary).chmod(0o755) run([inspector, stage / programs(target)[2], target]) shutil.copyfile(ROOT / 'LICENSE', stage / 'LICENSE') shutil.copyfile(ROOT / '.gitea/INSTALL.txt', stage / 'INSTALL.txt') manifest = dict(version=version, revision=revision, target=target, buildhost=platform.platform(), rustc=subprocess.check_output(['rustc', '--version'], text=True).strip(), build_image=os.environ.get('TB_BUILD_IMAGE', 'local'), cross_toolchain=json.loads(os.environ.get('TB_BUILD_METADATA', '{}')), source_dirty=bool(subprocess.check_output(['git', 'status', '--porcelain'], cwd=ROOT)), files={p.relative_to(stage).as_posix(): digest(p) for p in stage.rglob('*') if p.is_file()}) (stage / 'manifest.json').write_text(json.dumps(manifest, indent=2) + '\n') if target == list(TARGETS)[0]: run([sevenzip(), 'a', '-t7z', archive, *sorted(files(target))], cwd=stage, stdout=subprocess.DEVNULL) else: with tarfile.open(archive, 'w:gz') as tar: for filename in sorted(files(target)): tar.add(stage / filename, arcname=filename) verify(archive, target, inspector) (output / (archive.name + '.sha256')).write_text(f'{digest(archive)} {archive.name}\n') print(archive) def target_check(archive, target, output, windows_console_test=None): require(HOSTS.get((platform.system(), platform.machine())) == target, 'Echte Zielausführung erfordert passendes Hostsystem') require(not output.exists(), 'Nachweis existiert bereits') manifest = verify(archive, target) report = dict(target=target, revision=manifest['revision'], package=archive.name, package_sha256=digest(archive), tbl_sha256=TBL_SHA, host=platform.platform(), automated_passed=False, manual_terminal_passed=False, checks={}) output.mkdir(parents=True) try: with tempfile.TemporaryDirectory(prefix='tb-unpacked-') as temp: dest = Path(temp) unpack(archive, dest, target) env = dict(os.environ, PATH='') run([dest / programs(target)[0], '--help'], cwd=dest, env=env, stdout=subprocess.DEVNULL) source = dest / 'hello.bas'; source.write_text('PRINT 42\nEND\n') executable = dest / ('hello.exe' if os.name == 'nt' else 'hello') run([dest / programs(target)[1], 'build', source, '--exe', '--target', target, '-o', executable], cwd=dest, env=env) source.unlink() actual = subprocess.check_output([str(executable)], cwd=dest, env=env, timeout=30) require(actual.replace(b'\r\n', b'\n') == b' 42 \n', 'Standard-Vorlagenpfad funktioniert nicht') report['checks']['default-template'] = 'passed' commands = { 'native': [sys.executable, ROOT / 'tests/support/native-abnahme.py', '--bin-dir', dest, '--target', target], 'library': [sys.executable, ROOT / 'tests/support/library-abnahme.py', '--bin-dir', dest], } if os.name == 'posix': commands['ide-pty'] = [sys.executable, ROOT / 'tests/support/ide-execution-pty.py', '--binary', dest / 'tb'] if os.name == 'nt': require(windows_console_test and windows_console_test.is_file(), 'Windows-Konsolentest fehlt') report['windows_console_test_sha256'] = digest(windows_console_test) commands['windows-console'] = [windows_console_test, '--exact', 'terminal::tests::windows_console_restores_modes', '--ignored', '--nocapture'] for check, command in commands.items(): with (output / (check + '.log')).open('wb') as log: run(command, cwd=dest, stdout=log, stderr=subprocess.STDOUT) report['checks'][check] = 'passed' report['automated_passed'] = True finally: require(digest(archive) == report['package_sha256'], 'Paket während Zielprüfung verändert') (output / 'report.json').write_text(json.dumps(report, indent=2) + '\n') def gate(directory, evidence, revision, version): """Fail closed: vier exakte Pakete und unabhängige, passende Zielnachweise.""" require(re.fullmatch('[0-9a-f]{40}', revision), 'Ungültige Revision') require(digest(ROOT / 'tests/libraries/portable.tbl') == TBL_SHA, 'TBL-Probe verändert') assets = [] for target in TARGETS: archive = directory / name(version, target) require(archive.is_file(), f'Pflichtpaket fehlt: {archive.name}') sha = digest(archive) checksum = archive.with_name(archive.name + '.sha256') require(checksum.read_text() == f'{sha} {archive.name}\n', 'Paketprüfsumme falsch') manifest = verify(archive, target, ROOT / 'target/release/tb-template') require(manifest['revision'] == revision and not manifest['source_dirty'], 'Paket aus falschem/uncommittetem Stand') proof = json.loads((evidence / target / 'report.json').read_text()) require(proof.get('target') == target and proof.get('revision') == revision and proof.get('package') == archive.name and proof.get('package_sha256') == sha and proof.get('tbl_sha256') == TBL_SHA, 'Zielnachweis passt nicht zum Paket') required = {'native', 'library', 'default-template', 'windows-console' if target == list(TARGETS)[0] else 'ide-pty'} require(proof.get('automated_passed') is True and all(proof.get('checks', {}).get(k) == 'passed' for k in required), 'Automatisierte Zielprüfung fehlt') manual = json.loads((evidence / target / 'manual.json').read_text()) require(manual.get('revision') == revision and manual.get('package_sha256') == sha and manual.get('target') == target and manual.get('passed') is True and manual.get('tester') and manual.get('terminal_versions') and manual.get('evidence'), 'Manueller Terminalnachweis fehlt') terminals = {'windows-terminal'} if target == list(TARGETS)[0] else {'terminal.app'} if target == list(TARGETS)[1] else {'xterm', 'vte'} require(isinstance(manual['terminal_versions'], dict) and all(manual['terminal_versions'].get(t) for t in terminals), 'Pflichtemulator/Version fehlt') require(all(manual.get('cases', {}).get(k) is True for k in ('f1_f12', 'modifiers', 'mouse', 'unicode_colors', 'resize', 'input_break', 'shell')), 'Manuelle Pflichtfolge unvollständig') for reference in manual['evidence']: relative = Path(reference) require(not relative.is_absolute() and '..' not in relative.parts, 'Ungültiger manueller Nachweispfad') path = evidence / target / relative require(path.is_file() and path.stat().st_size > 0, 'Manueller Beleg fehlt') assets.extend([archive, checksum]) acceptance = json.loads((evidence / 'acceptance.json').read_text()) require(acceptance.get('revision') == revision and acceptance.get('passed') is True and all(acceptance.get(k) for k in ('foreign', 'inventory', 'workspace', 'benchmarks', 'native_ide', 'run_url', 'buildhost')), 'Pflichtabnahme/Benchmarks fehlen') return assets def main(): parser = argparse.ArgumentParser(description=__doc__) sub = parser.add_subparsers(dest='command', required=True) p = sub.add_parser('pack'); p.add_argument('--bin-dir', type=Path, required=True); p.add_argument('--output', type=Path, required=True) p.add_argument('--inspector', type=Path, required=True); p.add_argument('--target', choices=TARGETS, required=True) for command in ('verify', 'target-check'): p = sub.add_parser(command); p.add_argument('--archive', type=Path, required=True); p.add_argument('--target', choices=TARGETS, required=True) if command == 'verify': p.add_argument('--inspector', type=Path) else: p.add_argument('--output', type=Path, required=True) p.add_argument('--windows-console-test', type=Path) p = sub.add_parser('gate'); p.add_argument('--packages', type=Path, required=True); p.add_argument('--evidence', type=Path, required=True) p.add_argument('--revision', required=True); p.add_argument('--version', required=True) args = parser.parse_args() if args.command == 'pack': pack(args.bin_dir.resolve(), args.target, args.output.resolve(), args.inspector.resolve()) elif args.command == 'verify': verify(args.archive.resolve(), args.target, args.inspector.resolve() if args.inspector else None) elif args.command == 'target-check': target_check(args.archive.resolve(), args.target, args.output.resolve(), args.windows_console_test.resolve() if args.windows_console_test else None) else: gate(args.packages, args.evidence, args.revision, args.version) if __name__ == '__main__': main()