供应链与依赖治理

New-Item -ItemType Directory -Force l8-supply-chain
cd l8-supply-chain

mkdir -p l8-supply-chain
cd l8-supply-chain

"""校验固定版本和本地制品指纹，不安装或执行依赖。"""
from hashlib import sha256

# 已审核的制品内容与清单分开保管，清单不会随待检查内容重算。
APPROVED = b"notes-adapter:read-only:v1"
LOCK = {
    "notes-adapter": {"version": "1.2.0", "sha256": sha256(APPROVED).hexdigest()},
    "text-parser": {"version": "2.0.0", "sha256": sha256(b"text-parser:v2").hexdigest()},
}
ARTIFACTS = {
    "notes-adapter": ("1.2.0", APPROVED),
    "text-parser": ("2.0.0", b"text-parser:v2"),
}
TAMPER = False

def verify(lock, artifacts):
    # 额外依赖和遗漏依赖都破坏审核过的依赖集合。
    if set(lock) != set(artifacts):
        return ["依赖集合不同"]
    errors = []
    for name, expected in sorted(lock.items()):
        version, payload = artifacts[name]
        if version != expected["version"]:
            errors.append(f"{name}:版本不符")
        if sha256(payload).hexdigest() != expected["sha256"]:
            errors.append(f"{name}:指纹不符")
    return errors

def main():
    candidates = dict(ARTIFACTS)
    if TAMPER:
        # 改一个字节即可破坏完整性；这些字节始终作为数据处理。
        candidates["notes-adapter"] = ("1.2.0", APPROVED + b"!")
    errors = verify(LOCK, candidates)
    print("依赖数:", len(candidates))
    print("校验:", "通过" if not errors else "拒绝")
    print("原因:", "、".join(errors) if errors else "集合、版本、指纹一致")

if __name__ == "__main__":
    main()

"""覆盖完整性、版本锁定与依赖集合的变化。"""
import unittest
from verify_supply import APPROVED, LOCK, ARTIFACTS, verify

class SupplyTests(unittest.TestCase):
    def test_reviewed_artifacts(self):
        self.assertEqual(verify(LOCK, ARTIFACTS), [])

    def test_changed_byte(self):
        changed = dict(ARTIFACTS)
        changed["notes-adapter"] = ("1.2.0", APPROVED + b"!")
        self.assertEqual(verify(LOCK, changed), ["notes-adapter:指纹不符"])

    def test_same_bytes_new_version(self):
        changed = dict(ARTIFACTS)
        changed["notes-adapter"] = ("1.2.1", APPROVED)
        self.assertEqual(verify(LOCK, changed), ["notes-adapter:版本不符"])

    def test_missing_and_extra(self):
        self.assertEqual(verify(LOCK, {}), ["依赖集合不同"])
        self.assertEqual(verify(LOCK, {**ARTIFACTS, "extra": ("1", b"x")}),
                         ["依赖集合不同"])

    def test_empty_inventory(self):
        self.assertEqual(verify({}, {}), [])

if __name__ == "__main__":
    unittest.main()

ls
python -X utf8 verify_supply.py
python -X utf8 -m unittest -v test_verify_supply.py

依赖数: 2
校验: 通过
原因: 集合、版本、指纹一致

python -X utf8 verify_supply.py