53 lines
2.4 KiB
Python
53 lines
2.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Guest-only real Debian baseline and authenticated upgrade package acquisition."""
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
assert 'QEMU' in Path('/sys/class/dmi/id/sys_vendor').read_text()
|
|
assert subprocess.check_output(['findmnt', '-n', '-o', 'SOURCE', '/'], text=True).strip() == '/dev/vda'
|
|
os.environ['DEBIAN_FRONTEND'] = 'noninteractive'
|
|
|
|
def run(*args):
|
|
print('COMMAND', args, flush=True)
|
|
result = subprocess.run(args, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
|
|
print(result.stdout, flush=True)
|
|
result.check_returncode()
|
|
return result.stdout
|
|
|
|
def digest(path):
|
|
with path.open('rb') as f:
|
|
return hashlib.file_digest(f, 'sha256').hexdigest()
|
|
|
|
evidence = Path('/var/log/os-ota-baseline')
|
|
evidence.mkdir(exist_ok=False)
|
|
canaries = Path('/var/lib/archipelago/ota-synthetic-canaries')
|
|
before = {p.name: digest(p) for p in canaries.iterdir()}
|
|
print(run('apt-get', 'update'))
|
|
run('apt-get', '-y', '--no-install-recommends', 'install',
|
|
'linux-image-6.12.107+deb13-amd64=6.12.107-1',
|
|
'curl=8.14.1-2+deb13u5', 'libcurl4t64=8.14.1-2+deb13u5',
|
|
'initramfs-tools', 'grub-pc-bin', 'grub2-common')
|
|
Path('/etc/initramfs-tools/conf.d/resume').write_text('RESUME=none\n')
|
|
run('update-initramfs', '-u', '-k', '6.12.107+deb13-amd64')
|
|
Path('/boot/grub').mkdir(exist_ok=True)
|
|
run('update-grub')
|
|
run('apt-get', '-y', '--download-only', '--no-install-recommends', 'install',
|
|
'linux-image-6.12.113+deb13-amd64=6.12.113-1',
|
|
'curl=8.14.1-2+deb13u7', 'libcurl4t64=8.14.1-2+deb13u7')
|
|
packages = []
|
|
for path in sorted(Path('/var/cache/apt/archives').glob('*.deb')):
|
|
fields = run('dpkg-deb', '-f', str(path), 'Package', 'Version', 'Architecture')
|
|
packages.append({'file': str(path), 'sha256': digest(path), 'size': path.stat().st_size, 'fields': fields})
|
|
(evidence/(path.name+'.apt-metadata')).write_text(run('apt-cache', 'show', path.name.split('_')[0]))
|
|
after = {p.name: digest(p) for p in canaries.iterdir()}
|
|
assert before == after
|
|
receipt = {'baseline_kernel': '6.12.107+deb13-amd64', 'target_kernel': '6.12.113+deb13-amd64',
|
|
'packages': packages, 'canaries': before,
|
|
'qualification': 'authenticated-package-acquisition-only-not-D09-OTA'}
|
|
(evidence/'receipt.json').write_text(json.dumps(receipt, indent=2)+'\n')
|
|
print(json.dumps(receipt, indent=2))
|
|
print('BASELINE_APT_PREPARED_NO_OTA_PASS')
|