|
| 1 | +#!/usr/bin/env python3 |
| 2 | +import argparse |
| 3 | +import hashlib |
| 4 | +import json |
| 5 | +import os |
| 6 | +import sys |
| 7 | +from pathlib import Path |
| 8 | +from typing import Dict, List, NamedTuple, Tuple |
| 9 | + |
| 10 | + |
| 11 | +class BuildInfo(NamedTuple): |
| 12 | + commit_sha: str |
| 13 | + platform: str |
| 14 | + files: Dict[str, str] # relative path -> sha256 |
| 15 | + |
| 16 | + |
| 17 | +def calculate_checksum(file_path: Path) -> str: |
| 18 | + """Calculate SHA-256 checksum of a file.""" |
| 19 | + sha256_hash = hashlib.sha256() |
| 20 | + with open(file_path, "rb") as f: |
| 21 | + # Read in 1MB chunks to handle large files efficiently |
| 22 | + for byte_block in iter(lambda: f.read(4096 * 256), b""): |
| 23 | + sha256_hash.update(byte_block) |
| 24 | + return sha256_hash.hexdigest() |
| 25 | + |
| 26 | + |
| 27 | +def scan_deps(deps_dir: Path) -> Dict[str, str]: |
| 28 | + """Scan directory for dependency files and calculate their checksums.""" |
| 29 | + checksums = {} |
| 30 | + for file_path in deps_dir.rglob("*"): |
| 31 | + if not file_path.is_file(): |
| 32 | + continue |
| 33 | + |
| 34 | + # Only process shared libraries, static libraries, and headers |
| 35 | + if not ( |
| 36 | + file_path.suffix in [".so", ".dylib", ".a", ".h"] |
| 37 | + or ( |
| 38 | + file_path.suffix.startswith(".so.") |
| 39 | + or file_path.suffix.startswith(".dylib.") |
| 40 | + ) |
| 41 | + ): |
| 42 | + continue |
| 43 | + |
| 44 | + # Get path relative to deps_dir |
| 45 | + rel_path = str(file_path.relative_to(deps_dir)) |
| 46 | + try: |
| 47 | + checksums[rel_path] = calculate_checksum(file_path) |
| 48 | + except (IOError, OSError) as e: |
| 49 | + print(f"Error processing {rel_path}: {e}", file=sys.stderr) |
| 50 | + continue |
| 51 | + |
| 52 | + return checksums |
| 53 | + |
| 54 | + |
| 55 | +def generate_build_info(deps_dir: Path, platform: str, commit_sha: str) -> BuildInfo: |
| 56 | + """Generate build info for the given deps directory.""" |
| 57 | + checksums = scan_deps(deps_dir) |
| 58 | + return BuildInfo(commit_sha=commit_sha, platform=platform, files=checksums) |
| 59 | + |
| 60 | + |
| 61 | +def verify_deps(deps_dir: Path, build_info: BuildInfo) -> Tuple[bool, List[str]]: |
| 62 | + """Verify deps directory against build info.""" |
| 63 | + mismatches = [] |
| 64 | + valid = True |
| 65 | + |
| 66 | + # Get current state of deps directory |
| 67 | + current_checksums = scan_deps(deps_dir) |
| 68 | + |
| 69 | + print(f"Found {len(current_checksums)} files to verify") |
| 70 | + |
| 71 | + # Check for missing or mismatched files |
| 72 | + for rel_path, expected_checksum in build_info.files.items(): |
| 73 | + if rel_path not in current_checksums: |
| 74 | + mismatches.append(f"{rel_path}: file not found in deps directory") |
| 75 | + valid = False |
| 76 | + continue |
| 77 | + |
| 78 | + actual_checksum = current_checksums[rel_path] |
| 79 | + if actual_checksum != expected_checksum: |
| 80 | + mismatches.append( |
| 81 | + f"{rel_path}: checksum mismatch\n" |
| 82 | + f" expected: {expected_checksum}\n" |
| 83 | + f" got: {actual_checksum}" |
| 84 | + ) |
| 85 | + valid = False |
| 86 | + else: |
| 87 | + print(f"Verified: {rel_path}") |
| 88 | + |
| 89 | + # Check for extra files |
| 90 | + for rel_path in current_checksums: |
| 91 | + if rel_path not in build_info.files: |
| 92 | + mismatches.append(f"{rel_path}: extra file in deps directory") |
| 93 | + valid = False |
| 94 | + |
| 95 | + return valid, mismatches |
| 96 | + |
| 97 | + |
| 98 | +def main(): |
| 99 | + parser = argparse.ArgumentParser(description="Verify Lilliput dependencies") |
| 100 | + |
| 101 | + # Create subparsers first |
| 102 | + subparsers = parser.add_subparsers(dest="command", required=True) |
| 103 | + |
| 104 | + # Generate command |
| 105 | + generate_parser = subparsers.add_parser( |
| 106 | + "generate", help="Generate build info for dependencies" |
| 107 | + ) |
| 108 | + generate_parser.add_argument( |
| 109 | + "--deps-dir", required=True, type=Path, help="Directory containing dependencies" |
| 110 | + ) |
| 111 | + generate_parser.add_argument( |
| 112 | + "--platform", |
| 113 | + required=True, |
| 114 | + choices=["linux", "macos"], |
| 115 | + help="Platform identifier", |
| 116 | + ) |
| 117 | + generate_parser.add_argument( |
| 118 | + "--commit", required=True, help="Commit SHA that produced the build" |
| 119 | + ) |
| 120 | + generate_parser.add_argument( |
| 121 | + "--output", type=Path, help="Output file (default: <deps-dir>/build-info.json)" |
| 122 | + ) |
| 123 | + |
| 124 | + # Verify command |
| 125 | + verify_parser = subparsers.add_parser( |
| 126 | + "verify", help="Verify deps against build info" |
| 127 | + ) |
| 128 | + verify_parser.add_argument( |
| 129 | + "--deps-dir", required=True, type=Path, help="Directory containing dependencies" |
| 130 | + ) |
| 131 | + verify_parser.add_argument( |
| 132 | + "--build-info", required=True, type=Path, help="Path to build info JSON file" |
| 133 | + ) |
| 134 | + |
| 135 | + args = parser.parse_args() |
| 136 | + |
| 137 | + if not os.path.exists(args.deps_dir): |
| 138 | + print(f"Error: deps directory not found: {args.deps_dir}", file=sys.stderr) |
| 139 | + sys.exit(1) |
| 140 | + |
| 141 | + if args.command == "generate": |
| 142 | + build_info = generate_build_info(args.deps_dir, args.platform, args.commit) |
| 143 | + |
| 144 | + output_file = args.output or args.deps_dir / "build-info.json" |
| 145 | + |
| 146 | + try: |
| 147 | + with open(output_file, "w") as f: |
| 148 | + json.dump(build_info._asdict(), f, indent=4) |
| 149 | + print(f"Build info generated successfully: {output_file}") |
| 150 | + except (IOError, OSError) as e: |
| 151 | + print(f"Error writing build info: {e}", file=sys.stderr) |
| 152 | + sys.exit(1) |
| 153 | + |
| 154 | + elif args.command == "verify": |
| 155 | + try: |
| 156 | + with open(args.build_info) as f: |
| 157 | + build_info_dict = json.load(f) |
| 158 | + build_info = BuildInfo(**build_info_dict) |
| 159 | + except (IOError, OSError, json.JSONDecodeError) as e: |
| 160 | + print(f"Error reading build info: {e}", file=sys.stderr) |
| 161 | + sys.exit(1) |
| 162 | + |
| 163 | + print(f"Verifying deps against build from commit {build_info.commit_sha}") |
| 164 | + valid, mismatches = verify_deps(args.deps_dir, build_info) |
| 165 | + |
| 166 | + if not valid: |
| 167 | + print("\nVerification failed:") |
| 168 | + for mismatch in mismatches: |
| 169 | + print(f" {mismatch}") |
| 170 | + sys.exit(1) |
| 171 | + |
| 172 | + print("\nAll dependencies verified successfully") |
| 173 | + |
| 174 | + |
| 175 | +if __name__ == "__main__": |
| 176 | + main() |
0 commit comments