release: freeze Nexus One AI 1.0.0-rc1

release/1.0.0-rc1/qualify.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+"""Fail-closed static and clean-server evidence qualification for RC1."""
+import argparse, hashlib, json, os, platform, subprocess
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+RELEASE = Path(__file__).resolve().parent
+
+def sha(path):
+    h=hashlib.sha256()
+    with path.open("rb") as f:
+        for block in iter(lambda:f.read(1024*1024), b""): h.update(block)
+    return h.hexdigest()
+
+def main():
+    p=argparse.ArgumentParser(); p.add_argument("--iso"); p.add_argument("--clean-server", action="store_true"); p.add_argument("--output", required=True); a=p.parse_args()
+    checks=[]
+    def check(name, ok, evidence=""): checks.append({"name":name,"status":"pass" if ok else "fail","evidence":evidence})
+    manifest=json.loads((RELEASE/"release.json").read_text()); profiles=json.loads((RELEASE/"feature-profiles.json").read_text())
+    check("release-version", manifest.get("version")=="1.0.0-rc1")
+    check("model-less", manifest.get("modelPolicy")=="model-less" and not any("model" in x.lower() for x in manifest.get("includedProfiles",[])))
+    check("agent-runtimes-disabled", profiles.get("rc1AgentRuntimePolicy")=="deny-all" and all(v["limits"]["activeEdgeAgents"]==0 for v in profiles["profiles"].values()))
+    check("browser-commissioning", (ROOT/"autoinstall/websetup/server.py").is_file())
+    check("backup-restore", (ROOT/"scripts/cezen-backup.sh").is_file())
+    iso=Path(a.iso).resolve() if a.iso else None
+    check("iso-present", bool(iso and iso.is_file() and iso.stat().st_size>100_000_000), str(iso or "not supplied"))
+    if iso and iso.is_file(): check("iso-checksum", True, sha(iso))
+    check("clean-server", a.clean_server and platform.system()=="Linux" and os.geteuid()==0, "must run as root on wiped disposable Linux target")
+    check("disconnected", os.environ.get("NEXUS_OFFLINE_QUALIFICATION")=="1", "set only inside network-denied qualification lab")
+    result={"schema":"nexus.qualification.v1","release":"1.0.0-rc1","checks":checks,"qualified":all(x["status"]=="pass" for x in checks)}
+    Path(a.output).write_text(json.dumps(result,indent=2)+"\n")
+    raise SystemExit(0 if result["qualified"] else 1)
+
+if __name__=="__main__": main()