@mriekki/lean 0.4.0 → 0.4.2

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@mriekki/lean",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "defaultProfile": "greenfield-poc",
   "profiles": {
     "greenfield-poc": {
@@ -23,7 +23,7 @@
     },
     "deployment": {
       "repository": "mriekki/lean-poc-deployment-kit",
-      "commit": "4c23140576b39608a3ef285cad4abe53dccb9c47",
+      "commit": "2763e604c20e64720d7de71fa93a88d99677be36",
       "distribution": "greenfield-poc",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/deployment/distribution.json

@@ -18,9 +18,8 @@
     {"source": "src/lean_poc_deployment/errors.py", "destination": "tools/lean-deployment/lean_poc_deployment/errors.py"},
     {"source": "src/lean_poc_deployment/keys.py", "destination": "tools/lean-deployment/lean_poc_deployment/keys.py"},
     {"source": "src/lean_poc_deployment/profiles.py", "destination": "tools/lean-deployment/lean_poc_deployment/profiles.py"},
-    {"source": "src/lean_poc_deployment/teardown.py", "destination": "tools/lean-deployment/lean_poc_deployment/teardown.py"},
-    {"source": "src/lean_poc_deployment/teardown_cli.py", "destination": "tools/lean-deployment/lean_poc_deployment/teardown_cli.py"},
-    {"source": "src/lean_poc_deployment/teardown_remote.py", "destination": "tools/lean-deployment/lean_poc_deployment/teardown_remote.py"},
+    {"source": "src/lean_poc_deployment/registry_access.py", "destination": "tools/lean-deployment/lean_poc_deployment/registry_access.py"},
+    {"source": "src/lean_poc_deployment/registry_cli.py", "destination": "tools/lean-deployment/lean_poc_deployment/registry_cli.py"},
     {"source": "src/lean_poc_deployment/route_registry.py", "destination": "tools/lean-deployment/lean_poc_deployment/route_registry.py"},
     {"source": "src/lean_poc_deployment/route_registry_remote.py", "destination": "tools/lean-deployment/lean_poc_deployment/route_registry_remote.py"},
     {"source": "src/lean_poc_deployment/security.py", "destination": "tools/lean-deployment/lean_poc_deployment/security.py"},
@@ -29,6 +28,9 @@
     {"source": "src/lean_poc_deployment/sqlite_cli.py", "destination": "tools/lean-deployment/lean_poc_deployment/sqlite_cli.py"},
     {"source": "src/lean_poc_deployment/sqlite_import_recovery.py", "destination": "tools/lean-deployment/lean_poc_deployment/sqlite_import_recovery.py"},
     {"source": "src/lean_poc_deployment/ssh.py", "destination": "tools/lean-deployment/lean_poc_deployment/ssh.py"},
+    {"source": "src/lean_poc_deployment/teardown.py", "destination": "tools/lean-deployment/lean_poc_deployment/teardown.py"},
+    {"source": "src/lean_poc_deployment/teardown_cli.py", "destination": "tools/lean-deployment/lean_poc_deployment/teardown_cli.py"},
+    {"source": "src/lean_poc_deployment/teardown_remote.py", "destination": "tools/lean-deployment/lean_poc_deployment/teardown_remote.py"},
     {"source": "src/lean_poc_deployment/trust.py", "destination": "tools/lean-deployment/lean_poc_deployment/trust.py"}
   ]
 }

package/assets/generated/ASSEMBLY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@mriekki/lean",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "components": {
     "core": {
       "repository": "mriekki/lean-agentic-core",
@@ -243,7 +243,7 @@
     },
     "deployment": {
       "repository": "mriekki/lean-poc-deployment-kit",
-      "commit": "4c23140576b39608a3ef285cad4abe53dccb9c47",
+      "commit": "2763e604c20e64720d7de71fa93a88d99677be36",
       "distribution": "greenfield-poc",
       "files": [
         {
@@ -304,7 +304,7 @@
         {
           "source": "src/lean_poc_deployment/entrypoint.py",
           "destination": "tools/lean-deployment/lean_poc_deployment/entrypoint.py",
-          "sha256": "08a27a64680f7a72b68c6272f5185c7fdb23678efbda456fd0894272e2e6187e"
+          "sha256": "5161aec6d5a1fc684894a1011b3d577868cedaa7039ea647862a4628067fabd8"
         },
         {
           "source": "src/lean_poc_deployment/errors.py",
@@ -322,19 +322,14 @@
           "sha256": "9d73f86714db5c59a07354348e394647d62a3c31b173c4d3c4c4353872da908a"
         },
         {
-          "source": "src/lean_poc_deployment/teardown.py",
-          "destination": "tools/lean-deployment/lean_poc_deployment/teardown.py",
-          "sha256": "edcf921aa92988176b756abf4bbc9b0b83ae1d855b6e8d487b67aaad7727cb55"
+          "source": "src/lean_poc_deployment/registry_access.py",
+          "destination": "tools/lean-deployment/lean_poc_deployment/registry_access.py",
+          "sha256": "5815a1921ecf37dc395f9c68b1ebda2b17dd6a44620b2356d1adff5df44c4382"
         },
         {
-          "source": "src/lean_poc_deployment/teardown_cli.py",
-          "destination": "tools/lean-deployment/lean_poc_deployment/teardown_cli.py",
-          "sha256": "ec1271db5f57135189892e87f2df3ffc5fcb6e763ff1eb9604bc4e50788c3325"
-        },
-        {
-          "source": "src/lean_poc_deployment/teardown_remote.py",
-          "destination": "tools/lean-deployment/lean_poc_deployment/teardown_remote.py",
-          "sha256": "9745fd9f721eea2da8f5d32688cc6a293e46aa9f9e5c5825c6a08cacb1121fb1"
+          "source": "src/lean_poc_deployment/registry_cli.py",
+          "destination": "tools/lean-deployment/lean_poc_deployment/registry_cli.py",
+          "sha256": "6288d85ae44708362ba09e1b82546617a9660dd9d5601ced081ee44d3fc27bda"
         },
         {
           "source": "src/lean_poc_deployment/route_registry.py",
@@ -374,7 +369,22 @@
         {
           "source": "src/lean_poc_deployment/ssh.py",
           "destination": "tools/lean-deployment/lean_poc_deployment/ssh.py",
-          "sha256": "9eb568ec75a288b1069e629c67d567d5bb0a7a2074563c70f49057326154f7d2"
+          "sha256": "916a272ed5978df642e6084a3030c32f2c9dcb4b3b686a194428f9810ec55e9d"
+        },
+        {
+          "source": "src/lean_poc_deployment/teardown.py",
+          "destination": "tools/lean-deployment/lean_poc_deployment/teardown.py",
+          "sha256": "edcf921aa92988176b756abf4bbc9b0b83ae1d855b6e8d487b67aaad7727cb55"
+        },
+        {
+          "source": "src/lean_poc_deployment/teardown_cli.py",
+          "destination": "tools/lean-deployment/lean_poc_deployment/teardown_cli.py",
+          "sha256": "ec1271db5f57135189892e87f2df3ffc5fcb6e763ff1eb9604bc4e50788c3325"
+        },
+        {
+          "source": "src/lean_poc_deployment/teardown_remote.py",
+          "destination": "tools/lean-deployment/lean_poc_deployment/teardown_remote.py",
+          "sha256": "9745fd9f721eea2da8f5d32688cc6a293e46aa9f9e5c5825c6a08cacb1121fb1"
         },
         {
           "source": "src/lean_poc_deployment/trust.py",

package/assets/generated/deployment/src/lean_poc_deployment/entrypoint.py

@@ -6,6 +6,7 @@ import sys
 
 from .app_cli import main as app_main
 from .cli import main as core_main
+from .registry_cli import main as registry_main
 from .sqlite_cli import main as sqlite_main
 from .teardown_cli import main as teardown_main
 
@@ -14,12 +15,15 @@ def main(argv: list[str] | None = None) -> int:
     args = list(sys.argv[1:] if argv is None else argv)
     if args and args[0] == "app":
         return app_main(args[1:])
+    if args and args[0] == "registry":
+        return registry_main(args[1:])
     if args and args[0] == "sqlite":
         return sqlite_main(args[1:])
     if args and args[0] == "tear-down":
         return teardown_main(args[1:])
     if not args or args == ["--help"] or args == ["-h"]:
         print("Command group: app  Generic immutable application runtime inventory/deployment")
+        print("Command group: registry  Read-only exact-image registry access verification")
         print("Command group: sqlite  SQLite persistence import/backup/migration/rollback checks")
         print("Command group: tear-down  Scoped destructive POC environment/local cleanup")
     return core_main(args)

package/assets/generated/deployment/src/lean_poc_deployment/registry_access.py

@@ -0,0 +1,114 @@
+"""Read-only exact-image registry access verification for logical targets."""
+
+from __future__ import annotations
+
+import re
+import shlex
+import subprocess
+from typing import Any
+
+from .errors import DeploymentKitError
+from .profiles import load_profile
+from .ssh import ssh_args, verify_access
+
+
+_IMAGE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/:+-]*@sha256:[0-9a-f]{64}$")
+
+_REMOTE_SCRIPT = r'''#!/usr/bin/env bash
+set -Eeuo pipefail
+
+unset DOCKER_CONFIG
+
+IMAGE="$1"
+
+[[ "$IMAGE" =~ ^[A-Za-z0-9][A-Za-z0-9._/:+-]*@sha256:[0-9a-f]{64}$ ]] || {
+    echo "Image must be an immutable sha256 digest reference." >&2
+    exit 41
+}
+
+command -v docker >/dev/null 2>&1 || {
+    echo "Docker CLI is unavailable on the target." >&2
+    exit 42
+}
+
+config_dir="$HOME/.docker"
+config_file="$config_dir/config.json"
+credential_state="absent"
+
+if [[ -e "$config_file" ]]; then
+    [[ -d "$config_dir" && ! -L "$config_dir" && -f "$config_file" && ! -L "$config_file" ]] || {
+        echo "Docker credential path is not a regular protected directory/file." >&2
+        exit 43
+    }
+    dir_mode="$(stat -c '%a' "$config_dir")"
+    file_mode="$(stat -c '%a' "$config_file")"
+    current_uid="$(id -u)"
+    if (( (8#$dir_mode & 077) != 0 || (8#$file_mode & 077) != 0 )) ||
+       [[ "$(stat -c '%u' "$config_dir")" != "$current_uid" || "$(stat -c '%u' "$config_file")" != "$current_uid" ]]; then
+        echo "Docker credentials must be owned by the deployment account and deny group/other access." >&2
+        exit 43
+    fi
+    export DOCKER_CONFIG="$config_dir"
+    credential_state="protected"
+fi
+
+if ! docker manifest inspect "$IMAGE" </dev/null >/dev/null 2>&1; then
+    echo "Registry manifest access failed for the exact image." >&2
+    exit 44
+fi
+
+printf 'ACCESS\t%s\n' "$credential_state"
+'''
+
+
+def normalize_registry_image(value: str) -> str:
+    if not isinstance(value, str) or _IMAGE_RE.fullmatch(value) is None:
+        raise DeploymentKitError(
+            "image must be an immutable image reference ending in @sha256:<64 lowercase hex>."
+        )
+    return value
+
+
+def build_remote_script() -> str:
+    return _REMOTE_SCRIPT
+
+
+def _parse_access(output: str) -> str:
+    lines = [line for line in output.splitlines() if line]
+    if len(lines) != 1:
+        raise DeploymentKitError("Malformed registry access verification output.")
+    parts = lines[0].split("\t")
+    if len(parts) != 2 or parts[0] != "ACCESS" or parts[1] not in {"absent", "protected"}:
+        raise DeploymentKitError("Malformed registry access verification output.")
+    return parts[1]
+
+
+def verify_registry_access(name: str, image: str) -> dict[str, Any]:
+    exact_image = normalize_registry_image(image)
+    profile = load_profile(name)
+    access = verify_access(profile)
+    command = ssh_args(
+        profile,
+        access["address"],
+        command="bash -s -- " + shlex.quote(exact_image),
+    )
+    completed = subprocess.run(
+        command,
+        input=build_remote_script().encode("utf-8"),
+        check=False,
+        capture_output=True,
+    )
+    stdout = completed.stdout.decode("utf-8", errors="replace")
+    stderr = completed.stderr.decode("utf-8", errors="replace")
+    if completed.returncode != 0:
+        detail = stderr.strip() or stdout.strip() or f"exit {completed.returncode}"
+        raise DeploymentKitError(f"Read-only registry access verification failed: {detail}")
+
+    credential_state = _parse_access(stdout)
+    return {
+        "targetName": name,
+        "image": exact_image,
+        "manifestAccess": "verified",
+        "credentialConfig": credential_state,
+        "mutated": False,
+    }

package/assets/generated/deployment/src/lean_poc_deployment/registry_cli.py

@@ -0,0 +1,51 @@
+"""CLI for read-only registry access verification."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from typing import Any
+
+from .errors import DeploymentKitError
+from .registry_access import verify_registry_access
+
+
+def _print(value: Any, *, as_json: bool) -> None:
+    if as_json:
+        print(json.dumps(value, indent=2, sort_keys=True))
+        return
+    if isinstance(value, dict):
+        for key, item in value.items():
+            print(f"{key}: {item}")
+        return
+    print(value)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="lean-poc-deploy registry")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    verify = sub.add_parser(
+        "verify",
+        help="Verify exact-image registry manifest access without pulling or modifying target state",
+    )
+    verify.add_argument("name")
+    verify.add_argument("--image", required=True)
+    verify.add_argument("--json", action="store_true")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        if args.command == "verify":
+            _print(
+                verify_registry_access(args.name, args.image),
+                as_json=args.json,
+            )
+            return 0
+    except DeploymentKitError as error:
+        print(f"ERROR: {error}", file=sys.stderr)
+        return 2
+    return 2

package/assets/generated/deployment/src/lean_poc_deployment/ssh.py

@@ -108,6 +108,7 @@ def verify_access(profile: dict[str, Any]) -> dict[str, str]:
             text=True,
             encoding="utf-8",
             errors="replace",
+            stdin=subprocess.DEVNULL,
         )
         if result.returncode == 0:
             return {"targetName": profile["targetName"], "address": address, "status": "verified"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/lean",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Public consumer distribution and updater for Lean engineering assets.",
   "type": "module",
   "bin": {