ci: gate RCs on verifiable artifacts (#339)

scripts/build_release.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Build a reproducible, verifiable Stackchain Dashboard release bundle."""
+
+from __future__ import annotations
+
+import argparse
+import gzip
+import hashlib
+import io
+import json
+import tarfile
+from pathlib import Path
+
+
+RUNTIME_DIRECTORIES = ("docs", "frontend", "src")
+RUNTIME_FILES = ("README.md", "requirements.txt")
+
+
+def sha256(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def runtime_files(root: Path) -> list[Path]:
+    files = [root / name for name in RUNTIME_FILES if (root / name).is_file()]
+    for name in RUNTIME_DIRECTORIES:
+        directory = root / name
+        if directory.is_dir():
+            files.extend(path for path in directory.rglob("*") if path.is_file())
+    return sorted(files, key=lambda path: path.relative_to(root).as_posix())
+
+
+def manifest_for(root: Path, files: list[Path], commit: str) -> dict:
+    return {
+        "schema_version": 1,
+        "commit": commit,
+        "files": {
+            path.relative_to(root).as_posix(): {
+                "sha256": sha256(path.read_bytes()),
+                "size": path.stat().st_size,
+            }
+            for path in files
+        },
+    }
+
+
+def json_bytes(payload: dict) -> bytes:
+    return (json.dumps(payload, indent=2, sort_keys=True) + "\n").encode()
+
+
+def tar_info(name: str, size: int, epoch: int, executable: bool = False) -> tarfile.TarInfo:
+    info = tarfile.TarInfo(name)
+    info.size = size
+    info.mtime = epoch
+    info.mode = 0o755 if executable else 0o644
+    info.uid = info.gid = 0
+    info.uname = info.gname = "root"
+    return info
+
+
+def build(root: Path, output_dir: Path, commit: str, epoch: int) -> tuple[Path, Path, Path]:
+    root = root.resolve()
+    files = runtime_files(root)
+    missing = [name for name in RUNTIME_FILES if not (root / name).is_file()]
+    if missing or not (root / "src").is_dir() or not (root / "frontend").is_dir():
+        raise ValueError("release root is missing required runtime files")
+
+    embedded_manifest = manifest_for(root, files, commit)
+    archive_members: dict[str, tuple[bytes, bool]] = {
+        path.relative_to(root).as_posix(): (
+            path.read_bytes(),
+            bool(path.stat().st_mode & 0o111),
+        )
+        for path in files
+    }
+    archive_members["release-manifest.json"] = (json_bytes(embedded_manifest), False)
+
+    output_dir.mkdir(parents=True, exist_ok=True)
+    stem = f"stackchain-dashboard-{commit[:12]}"
+    archive_path = output_dir / f"{stem}.tar.gz"
+    with archive_path.open("wb") as raw:
+        with gzip.GzipFile(fileobj=raw, mode="wb", filename="", mtime=epoch) as compressed:
+            with tarfile.open(fileobj=compressed, mode="w", format=tarfile.PAX_FORMAT) as archive:
+                for name in sorted(archive_members):
+                    data, executable = archive_members[name]
+                    archive.addfile(tar_info(name, len(data), epoch, executable), io.BytesIO(data))
+
+    archive_data = archive_path.read_bytes()
+    digest = sha256(archive_data)
+    public_manifest = {
+        **embedded_manifest,
+        "artifact": {
+            "name": archive_path.name,
+            "sha256": digest,
+            "size": len(archive_data),
+        },
+    }
+    manifest_path = output_dir / f"{stem}.manifest.json"
+    checksum_path = output_dir / f"{stem}.sha256"
+    manifest_path.write_bytes(json_bytes(public_manifest))
+    checksum_path.write_text(f"{digest}  {archive_path.name}\n")
+    return archive_path, manifest_path, checksum_path
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=Path.cwd())
+    parser.add_argument("--output-dir", type=Path, default=Path("dist"))
+    parser.add_argument("--commit", required=True)
+    parser.add_argument("--source-date-epoch", type=int, required=True)
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+    for path in build(args.root, args.output_dir, args.commit, args.source_date_epoch):
+        print(path)
+
+
+if __name__ == "__main__":
+    main()

scripts/verify_release.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Verify a Stackchain Dashboard release bundle before promotion."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import sys
+import tarfile
+from pathlib import Path, PurePosixPath
+
+
+def one(directory: Path, pattern: str) -> Path:
+    matches = sorted(directory.glob(pattern))
+    if len(matches) != 1:
+        raise ValueError(f"expected exactly one {pattern} file, found {len(matches)}")
+    return matches[0]
+
+
+def digest(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def verify(input_dir: Path, commit: str) -> None:
+    archive_path = one(input_dir, "*.tar.gz")
+    manifest_path = one(input_dir, "*.manifest.json")
+    checksum_path = one(input_dir, "*.sha256")
+    manifest = json.loads(manifest_path.read_text())
+
+    if manifest.get("commit") != commit:
+        raise ValueError("manifest commit does not match the tested commit")
+    artifact = manifest.get("artifact", {})
+    archive_data = archive_path.read_bytes()
+    archive_digest = digest(archive_data)
+    if artifact.get("name") != archive_path.name:
+        raise ValueError("manifest artifact name does not match the bundle")
+    if artifact.get("size") != len(archive_data) or artifact.get("sha256") != archive_digest:
+        raise ValueError("bundle does not match its manifest")
+
+    checksum_parts = checksum_path.read_text().strip().split()
+    if checksum_parts != [archive_digest, archive_path.name]:
+        raise ValueError("checksum file does not match the bundle")
+
+    expected_files = manifest.get("files")
+    if not isinstance(expected_files, dict):
+        raise ValueError("manifest files must be an object")
+    with tarfile.open(archive_path, "r:gz") as archive:
+        members = archive.getmembers()
+        for member in members:
+            path = PurePosixPath(member.name)
+            if path.is_absolute() or ".." in path.parts or not member.isfile():
+                raise ValueError("bundle contains an unsafe member")
+        names = {member.name for member in members}
+        if names != set(expected_files) | {"release-manifest.json"}:
+            raise ValueError("bundle contents do not match the manifest")
+        embedded_file = archive.extractfile("release-manifest.json")
+        if embedded_file is None:
+            raise ValueError("bundle manifest is missing")
+        embedded = json.load(embedded_file)
+        if embedded.get("commit") != commit or embedded.get("files") != expected_files:
+            raise ValueError("embedded manifest does not match the public manifest")
+        for name, metadata in expected_files.items():
+            bundled = archive.extractfile(name)
+            if bundled is None:
+                raise ValueError(f"bundle member is missing: {name}")
+            data = bundled.read()
+            if metadata != {"sha256": digest(data), "size": len(data)}:
+                raise ValueError(f"bundle member failed verification: {name}")
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--input-dir", type=Path, required=True)
+    parser.add_argument("--commit", required=True)
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+    try:
+        verify(args.input_dir, args.commit)
+    except (OSError, ValueError, json.JSONDecodeError, tarfile.TarError) as error:
+        print(f"release verification failed: {error}", file=sys.stderr)
+        raise SystemExit(1) from error
+    print(f"verified release bundle for {args.commit}")
+
+
+if __name__ == "__main__":
+    main()