35 lines
2.2 KiB
Python
Executable File
35 lines
2.2 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Fail-closed static and clean-server evidence qualification for RC1."""
|
|
import argparse, hashlib, json, os, platform, subprocess
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
RELEASE = Path(__file__).resolve().parent
|
|
|
|
def sha(path):
|
|
h=hashlib.sha256()
|
|
with path.open("rb") as f:
|
|
for block in iter(lambda:f.read(1024*1024), b""): h.update(block)
|
|
return h.hexdigest()
|
|
|
|
def main():
|
|
p=argparse.ArgumentParser(); p.add_argument("--iso"); p.add_argument("--clean-server", action="store_true"); p.add_argument("--output", required=True); a=p.parse_args()
|
|
checks=[]
|
|
def check(name, ok, evidence=""): checks.append({"name":name,"status":"pass" if ok else "fail","evidence":evidence})
|
|
manifest=json.loads((RELEASE/"release.json").read_text()); profiles=json.loads((RELEASE/"feature-profiles.json").read_text())
|
|
check("release-version", manifest.get("version")=="1.0.0-rc1")
|
|
check("model-less", manifest.get("modelPolicy")=="model-less" and not any("model" in x.lower() for x in manifest.get("includedProfiles",[])))
|
|
check("agent-runtimes-disabled", profiles.get("rc1AgentRuntimePolicy")=="deny-all" and all(v["limits"]["activeEdgeAgents"]==0 for v in profiles["profiles"].values()))
|
|
check("browser-commissioning", (ROOT/"autoinstall/websetup/server.py").is_file())
|
|
check("backup-restore", (ROOT/"scripts/cezen-backup.sh").is_file())
|
|
iso=Path(a.iso).resolve() if a.iso else None
|
|
check("iso-present", bool(iso and iso.is_file() and iso.stat().st_size>100_000_000), str(iso or "not supplied"))
|
|
if iso and iso.is_file(): check("iso-checksum", True, sha(iso))
|
|
check("clean-server", a.clean_server and platform.system()=="Linux" and os.geteuid()==0, "must run as root on wiped disposable Linux target")
|
|
check("disconnected", os.environ.get("NEXUS_OFFLINE_QUALIFICATION")=="1", "set only inside network-denied qualification lab")
|
|
result={"schema":"nexus.qualification.v1","release":"1.0.0-rc1","checks":checks,"qualified":all(x["status"]=="pass" for x in checks)}
|
|
Path(a.output).write_text(json.dumps(result,indent=2)+"\n")
|
|
raise SystemExit(0 if result["qualified"] else 1)
|
|
|
|
if __name__=="__main__": main()
|