#!/usr/bin/env python3 """Independent cold-boot and preservation observer inside the disposable disk.""" import json from pathlib import Path import platform import subprocess import sys assert 'QEMU' in Path('/sys/class/dmi/id/sys_vendor').read_text() assert subprocess.check_output(['findmnt', '-n', '-o', 'SOURCE', '/'], text=True).strip() == '/dev/vda' sys.path.insert(0, '/opt/ota-source/scripts') import os_update_executor as executor from os_update_plan import canonical evidence = Path('/var/log/os-ota-stage') binding = json.loads((evidence/'binding.json').read_text()) plan = json.loads((evidence/'plan.json').read_text()) applied = json.loads((evidence/'apply-result.json').read_text()) canaries = Path('/var/lib/archipelago/ota-synthetic-canaries') expected = json.loads((evidence/'canaries-after.json').read_text()) actual = {p.name: executor.file_hash(p) for p in canaries.iterdir()} assert actual == expected assert platform.release() == plan['boot']['expected_release'] assert executor.boot_id() != applied['boot_id'] instance = executor.Executor(binding['os_update']) observation = dict(version=1, authority_digest=binding['os_update']['authority_digest'], plan_sha256=binding['os_update']['plan_sha256'], boot_id=executor.boot_id(), preservation_verified=True) (instance.source/'postboot-preservation.json').write_bytes(canonical(observation)) status = executor.stage(binding, 'APPLY', 'postboot') assert status['phase'] == 'POSTBOOT_CONFIRMED' assert executor.stage(binding, 'APPLY', 'apply') == status assert {p.name: executor.file_hash(p) for p in canaries.iterdir()} == expected result = dict(cold_boot=True, running_kernel=platform.release(), boot_id=executor.boot_id(), phase=status['phase'], forward_wallet_write_preserved=True, identities_stopped_uninstall_preserved=True, production_approved=False, boot_method='see host QEMU command receipt; guest confirms running kernel and fresh boot ID') (evidence/'postboot-result.json').write_text(json.dumps(result, indent=2)+'\n') print(json.dumps(result, indent=2))