@runeditrun/rer 0.2.0 → 0.2.2

package/scripts/publish-check/source_metadata.py

@@ -0,0 +1,62 @@
+"""Digest fields in the formats emitted by edition-authoring cli/sources.mjs.
+
+This recognizes metadata, not its freshness or integrity. Authoring's check
+owns those validations; a retained, unselected archive is still metadata.
+Only enumerated JSON value locations qualify, never arbitrary nested names.
+"""
+import re
+from json_identity import HEX, GIT_REVISION
+import source_shapes
+
+ARCHIVE = re.compile(r'\.edition/sources/([a-f0-9]{64})\.json\Z')
+
+
+def fields(value, pointer, names, pattern=HEX):
+    if isinstance(value, dict):
+        for name in names:
+            if isinstance(value.get(name), str) and pattern.fullmatch(value[name]):
+                yield (*pointer, name)
+
+
+def pin(value, pointer):
+    # sources.mjs and cli.mjs emit this same three-digest reference shape.
+    if source_shapes.pin(value):
+        yield from fields(value, pointer, ('key', 'digest', 'sha256'))
+
+
+def origin(value, pointer):
+    # snapshotOrigin in projection-lock.mjs copies one immutable identity.
+    if not source_shapes.reference(value):
+        return
+    if 'projection' not in value:
+        yield from fields(value, pointer, ('revision',), GIT_REVISION)
+    else:
+        yield from fields(value['projection'], (*pointer, 'projection'), ('originalSha256', 'recipeSha256'))
+
+
+def source_pointers(path, value):
+    if not isinstance(value, dict):
+        return
+    if path == 'sources.lock.json':
+        if not source_shapes.lock(value):
+            return
+        yield from fields(value, (), ('manifest',))
+        yield from fields(value['toolchain'], ('toolchain',), ('sha256',))
+        yield from pin(value.get('parent'), ('parent',))
+        for index, component in enumerate(value['components']):
+            pointer = ('components', index)
+            yield from pin(component.get('baseline'), (*pointer, 'baseline'))
+            source = component['source']
+            if source['kind'] == 'git':
+                yield from origin(source, (*pointer, 'source'))
+            else:
+                yield from origin(source.get('origin'), (*pointer, 'source', 'origin'))
+        for name, entry in value['files'].items():
+            yield from fields(entry, ('files', name), ('sha256',))
+    elif ARCHIVE.fullmatch(path):
+        if not source_shapes.archive(value):
+            return
+        yield from fields(value, (), ('key', 'digest'))
+        yield from origin(value['origin'], ('origin',))
+        for index, dependency in enumerate(value.get('dependencies', [])):
+            yield from pin(dependency, ('dependencies', index))

package/scripts/publish-check/source_shapes.py

@@ -0,0 +1,91 @@
+"""Local record shapes emitted by edition-authoring, without integrity checks."""
+import re
+from copy_identities import relative_path
+from json_identity import HEX, GIT_REVISION
+
+IDENTITY = re.compile(r'[a-zA-Z0-9][a-zA-Z0-9._-]*/[a-zA-Z0-9][a-zA-Z0-9._-]*\Z')
+
+
+def matches(value, pattern=HEX):
+    return isinstance(value, str) and bool(pattern.fullmatch(value))
+
+
+def pin(value):
+    return isinstance(value, dict) and all(matches(value.get(k)) for k in ('key', 'digest', 'sha256'))
+
+
+def paths(value):
+    return isinstance(value, list) and bool(value) and all(relative_path(p) for p in value)
+
+
+def reference(value, snapshot=False):
+    # manifest.origin supplies the identity; snapshotOrigin additionally emits
+    # normalized path/paths/excludeSnapshots fields on every retained archive.
+    if (not isinstance(value, dict) or not isinstance(value.get('repository'), str)
+            or not value['repository'] or value['repository'].startswith('-')):
+        return False
+    if 'projection' in value:
+        projection = value['projection']
+        if ('revision' in value or not isinstance(projection, dict)
+                or set(projection) != {'schemaVersion', 'originalSha256', 'recipeSha256'}
+                or type(projection['schemaVersion']) is not int or projection['schemaVersion'] != 1
+                or not all(matches(projection[k]) for k in ('originalSha256', 'recipeSha256'))):
+            return False
+    elif not matches(value.get('revision'), GIT_REVISION):
+        return False
+    if snapshot and not {'path', 'paths', 'excludeSnapshots'} <= value.keys():
+        return False
+    return (('path' not in value or value['path'] == '.' or relative_path(value['path']))
+            and (value.get('paths') is None or paths(value['paths']))
+            and ('excludeSnapshots' not in value or type(value['excludeSnapshots']) is bool))
+
+
+def file_records(value, archived=False):
+    if not isinstance(value, dict):
+        return False
+    # Payload bytes need not be present elsewhere or agree with a digest.
+    # Empty retained file maps are still metadata.
+    return all(relative_path(name) and isinstance(record, dict)
+               and type(record.get('executable')) is bool
+               and (isinstance(record.get('data'), str) if archived else matches(record.get('sha256')))
+               for name, record in value.items())
+
+
+def archive(value):
+    return (isinstance(value, dict) and all(matches(value.get(k)) for k in ('key', 'digest'))
+            and reference(value.get('origin'), snapshot=True)
+            and file_records(value.get('files'), archived=True)
+            and isinstance(value.get('dependencies', []), list)
+            and all(pin(dependency) for dependency in value.get('dependencies', [])))
+
+
+def source(value):
+    if not isinstance(value, dict):
+        return False
+    if value.get('kind') == 'git':
+        return reference(value) and relative_path(value.get('destination'))
+    if value.get('kind') != 'local' or not paths(value.get('paths')):
+        return False
+    mappings = value.get('mappings')
+    return ((value.get('origin') is None or reference(value['origin']))
+            and (mappings is None or (isinstance(mappings, list)
+                 and all(isinstance(m, dict) and relative_path(m.get('path'))
+                         and relative_path(m.get('originPath')) for m in mappings))))
+
+
+def lock(value):
+    if (not isinstance(value, dict) or type(value.get('schemaVersion')) is not int
+            or value['schemaVersion'] != 1 or not matches(value.get('edition'), IDENTITY)
+            or not matches(value.get('manifest')) or 'parent' not in value
+            or (value['parent'] is not None and not pin(value['parent']))
+            or not isinstance(value.get('components'), list) or not file_records(value.get('files'))):
+        return False
+    toolchain = value.get('toolchain')
+    if (not isinstance(toolchain, dict) or toolchain.get('id') != 'runeditrun/edition-authoring'
+            or not isinstance(toolchain.get('version'), str) or not toolchain['version']
+            or not matches(toolchain.get('sha256'))):
+        return False
+    return all(isinstance(component, dict) and matches(component.get('id'), IDENTITY)
+               and source(component.get('source')) and 'baseline' in component
+               and (component['baseline'] is None or pin(component['baseline']))
+               for component in value['components'])

package/scripts/publish-check/tree_scan.py

@@ -37,8 +37,8 @@ def context(history, commit, config):
             'trustBundles': trust}, invalid
 
 
-def text_rules(data, path, config, resolver, env_hashes):
-    rules, provenance = inspect(data, path, config, resolver)
+def text_rules(data, path, config, resolver, env_hashes, *, commit_message=False):
+    rules, provenance = inspect(data, path, config, resolver, commit_message=commit_message)
     path_rules, _ = inspect(path.encode('utf-8', 'surrogateescape'), '@path', config, resolver)
     rules.update(path_rules)
     if env_hashes and (environment_match(data, env_hashes) or environment_match(path.encode(), env_hashes)):

package/scripts/publish-check/source_hashes.mjs

@@ -1,6 +0,0 @@
-// Reuse the maintained Source serializer; never approximate JSON.stringify in
-// another language. Input and output stay on private subprocess pipes.
-import fs from 'node:fs';
-import {hash, json} from '../../edition-authoring/files.mjs';
-const values = JSON.parse(fs.readFileSync(0, 'utf8'));
-process.stdout.write(JSON.stringify(values.map(value => hash(json(value)))));