88af7fd9ce
The bundle carries ~40 wheels, a Python installer and two MSIs. All of them run as SYSTEM on the target server, and nothing verified any of them. A missing wheelhouse printed MISSING and the script still exited 0, so an empty bundle compiled into a shippable installer and the failure surfaced on an air-gapped server with no way to fix it. bundle-lock.json now records that payload exactly - sha256 and byte size per file - and verification is set equality: a missing file, an unexpected extra file, or changed content all fail. Both builders check it and refuse to produce an unverified bundle; the lock ships inside the bundle and shopdb-install.ps1 re-checks it on the server before running any of it. This is deliberately a layer above requirements.txt hashes. pip lists every artifact of a pinned version (cffi 2.1.0 alone has 100 hashes), so it proves a wheel is genuine, not that it is the wheel this bundle was built and tested with; it ignores extra files in the wheelhouse; and it covers none of the executables. refresh-bundle-lock.ps1 regenerates the lock but refuses to overwrite one until the operator has seen the diff, because the commit is the review - it is the only place a change to what runs as SYSTEM becomes visible to a human. build-installer.ps1 is the whole build natively on Windows, so a work PC needs no Bash. It shares the plugin closure resolver with build-site.sh. Both builders now copy the installer scripts from the repository. They were copied from a downloads folder, so the logic that shipped was not the logic that was committed and the build worked on exactly one machine. Two verifiers exist because PowerShell is the only thing guaranteed present on the target server, while the Linux builder should not need pwsh. tests/test_bundle_lock.py runs both against the same fixtures and fails if they disagree.
120 lines
4.5 KiB
Python
120 lines
4.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Check a staged installer bundle against bundle-lock.json.
|
|
|
|
Prints one line per problem and exits non-zero if there are any. Exits 0 only
|
|
when the bundle's third-party payload is EXACTLY what the lock describes: no
|
|
missing file, no unexpected extra file, no changed content.
|
|
|
|
Why this exists alongside bundle-lock.ps1, which does the same job:
|
|
|
|
- bundle-lock.ps1 is canonical. It runs at INSTALL time on the target server,
|
|
where PowerShell is the only thing guaranteed to be present - Python is not
|
|
installed until stage 2, and verifying the payload after running part of it
|
|
would defeat the purpose.
|
|
- This file lets the Linux builder (build-installer.sh) do the same check
|
|
without adding pwsh as a build dependency.
|
|
|
|
The two are kept honest by tests/test_bundle_lock.py, which runs BOTH against
|
|
the same fixtures and fails if they disagree.
|
|
|
|
Usage: verify_bundle_lock.py <bundle-root> <bundle-lock.json>
|
|
"""
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import sys
|
|
|
|
# Must match $script:BundlePayloads in bundle-lock.ps1.
|
|
PAYLOADS = [
|
|
('wheels', True, 'Python wheels for the offline install'),
|
|
('python', True, 'the Python installer'),
|
|
('httpplatformhandler', True, 'the IIS module that launches waitress'),
|
|
('urlrewrite', False, 'IIS URL Rewrite, for the client-IP rule'),
|
|
('mysql', False, 'MySQL, for the bundled-database option'),
|
|
]
|
|
|
|
|
|
def digest(path):
|
|
sha = hashlib.sha256()
|
|
with open(path, 'rb') as fh:
|
|
for chunk in iter(lambda: fh.read(1024 * 1024), b''):
|
|
sha.update(chunk)
|
|
return sha.hexdigest()
|
|
|
|
|
|
def payload_files(directory):
|
|
"""Every file under the directory, keyed by forward-slashed relative path."""
|
|
found = {}
|
|
if not os.path.isdir(directory):
|
|
return found
|
|
for root, _dirs, files in os.walk(directory):
|
|
for name in files:
|
|
full = os.path.join(root, name)
|
|
rel = os.path.relpath(full, directory).replace(os.sep, '/')
|
|
found[rel] = {'sha256': digest(full), 'size': os.path.getsize(full)}
|
|
return found
|
|
|
|
|
|
def verify(bundle_root, lock):
|
|
problems = []
|
|
locked = lock.get('payloads')
|
|
if not locked:
|
|
return ['bundle-lock.json has no "payloads" section']
|
|
|
|
for name, required, what in PAYLOADS:
|
|
directory = os.path.join(bundle_root, name)
|
|
present = os.path.isdir(directory)
|
|
if name not in locked:
|
|
if present:
|
|
problems.append(
|
|
'%s/ is present but is not in bundle-lock.json - regenerate the lock' % name)
|
|
elif required:
|
|
problems.append(
|
|
'%s/ is required but is in neither the bundle nor the lock' % name)
|
|
continue
|
|
if not present:
|
|
if required or locked[name].get('required'):
|
|
problems.append('%s/ is in the lock but missing from the bundle (%s)' % (name, what))
|
|
continue
|
|
|
|
expected = locked[name].get('files', {})
|
|
actual = payload_files(directory)
|
|
for rel, want in sorted(expected.items()):
|
|
got = actual.get(rel)
|
|
if got is None:
|
|
problems.append('%s/%s is in the lock but missing from the bundle' % (name, rel))
|
|
elif got['sha256'] != want['sha256']:
|
|
problems.append(
|
|
'%s/%s does NOT match the lock (expected sha256 %s..., got %s...)'
|
|
% (name, rel, want['sha256'][:12], got['sha256'][:12]))
|
|
elif int(got['size']) != int(want['size']):
|
|
# Impossible for a matching sha256, so the lock was hand-edited.
|
|
problems.append(
|
|
'%s/%s size disagrees with the lock - the lock has been edited by hand'
|
|
% (name, rel))
|
|
for rel in sorted(actual):
|
|
if rel not in expected:
|
|
problems.append(
|
|
'%s/%s is in the bundle but NOT in the lock (unexpected extra file)'
|
|
% (name, rel))
|
|
return problems
|
|
|
|
|
|
def main():
|
|
if len(sys.argv) != 3:
|
|
sys.exit('usage: verify_bundle_lock.py <bundle-root> <bundle-lock.json>')
|
|
bundle_root, lock_path = sys.argv[1], sys.argv[2]
|
|
if not os.path.exists(lock_path):
|
|
print('no bundle-lock.json at %s' % lock_path)
|
|
return 1
|
|
with open(lock_path) as fh:
|
|
lock = json.load(fh)
|
|
problems = verify(bundle_root, lock)
|
|
for problem in problems:
|
|
print(problem)
|
|
return 1 if problems else 0
|
|
|
|
|
|
if __name__ == '__main__':
|
|
sys.exit(main())
|