32 lines
1.6 KiB
Python
32 lines
1.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Validate a retained pre-effect VERIFIED plan after an executor source fix.
|
|
|
|
No ledger reset, preparation replay, package effects or financial restoration.
|
|
Only a still-VERIFIED authority with exact before-inventory/archives is accepted.
|
|
"""
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
|
|
assert 'QEMU' in Path('/sys/class/dmi/id/sys_vendor').read_text()
|
|
assert subprocess.check_output(['findmnt','-n','-o','SOURCE','/'],text=True).strip()=='/dev/vda'
|
|
sys.path.insert(0,'/opt/ota-source/scripts')
|
|
import os_update_executor as executor
|
|
evidence=Path('/var/log/os-ota-stage')
|
|
binding=json.loads((evidence/'binding.json').read_text())
|
|
instance=executor.Executor(binding['os_update'])
|
|
assert instance.status['phase']=='VERIFIED', 'effects/uncertainty require external reconciliation; never reset'
|
|
before=instance.status_path.read_bytes()
|
|
instance.preflight()
|
|
instance.verify_archives()
|
|
assert instance.status_path.read_bytes()==before
|
|
for name,expected in json.loads((evidence/'canaries-before.json').read_text()).items():
|
|
assert executor.file_hash(Path('/var/lib/archipelago/ota-synthetic-canaries')/name)==expected
|
|
result=dict(phase='VERIFIED',authority_unchanged=True,inventory_and_archives_exact=True,
|
|
packages_changed=False,financial_rollback=False,production_approved=False,
|
|
source_hashes={p.name:executor.file_hash(p) for p in Path('/opt/ota-source/scripts').glob('os_update_*.py')})
|
|
(evidence/('executor-refresh-'+str(time.time_ns())+'.json')).write_text(json.dumps(result,indent=2)+'\n')
|
|
print(json.dumps(result,indent=2),flush=True)
|