151 lines
5.0 KiB
Python
151 lines
5.0 KiB
Python
#!/usr/bin/env python3
|
|
"""Verifies sol-profile-triage artifacts against ground truth recomputed from disk.
|
|
|
|
Cross-checks:
|
|
(a) path set in manifest == real files on disk (no fabrication, no omissions)
|
|
(b) manifest.total_files == disk file count
|
|
(c) per-category counts match a fresh rules-based walk of the disk
|
|
(d) shell find cross-checks on the cleanly-separable buckets
|
|
|
|
Exits 0 only if every check passes (so its exit code is the verdict).
|
|
"""
|
|
import json
|
|
import os
|
|
import stat
|
|
import subprocess
|
|
import sys
|
|
|
|
ROOT = "/root/.hermes/profiles/sol"
|
|
OUT = "/root/.hermes/wizard-outputs/sol"
|
|
MANIFEST = os.path.join(OUT, "sol-profile-triage-manifest.json")
|
|
REPORT = os.path.join(OUT, "sol-profile-triage-report.md")
|
|
|
|
CATEGORY_ORDER = [
|
|
"SECRETS", "BACKUP", "CACHE", "LOG", "BIN", "CRON", "FORGE",
|
|
"HOOKS", "SOURCE", "CONFIG", "SHELL", "DATA", "DOC", "MISC",
|
|
]
|
|
|
|
|
|
def classify(rel_parts, basename):
|
|
if "keys" in rel_parts or basename == "auth.json":
|
|
return "SECRETS"
|
|
if "backups" in rel_parts or ".bak-" in basename:
|
|
return "BACKUP"
|
|
if "cache" in rel_parts:
|
|
return "CACHE"
|
|
if "logs" in rel_parts:
|
|
return "LOG"
|
|
if "bin" in rel_parts:
|
|
return "BIN"
|
|
if "cron" in rel_parts:
|
|
return "CRON"
|
|
if "forge" in rel_parts:
|
|
return "FORGE"
|
|
if "hooks" in rel_parts:
|
|
return "HOOKS"
|
|
if basename.endswith(".py"):
|
|
return "SOURCE"
|
|
if basename.endswith((".yaml", ".yml", ".json", ".toml", ".lock", ".etag")):
|
|
return "CONFIG"
|
|
if basename.endswith(".sh"):
|
|
return "SHELL"
|
|
if basename.endswith(".db"):
|
|
return "DATA"
|
|
if basename.endswith((".md", ".txt")) or basename == "LICENSE":
|
|
return "DOC"
|
|
return "MISC"
|
|
|
|
|
|
def main():
|
|
with open(MANIFEST) as f:
|
|
man = json.load(f)
|
|
|
|
disk = set()
|
|
for dirpath, dirnames, filenames in os.walk(ROOT):
|
|
for fn in filenames:
|
|
full = os.path.join(dirpath, fn)
|
|
try:
|
|
st = os.lstat(full)
|
|
except OSError:
|
|
continue
|
|
if stat.S_ISLNK(st.st_mode) or stat.S_ISSOCK(st.st_mode):
|
|
continue
|
|
disk.add(os.path.relpath(full, ROOT))
|
|
|
|
man_paths = [e["path"] for e in man.get("files", [])]
|
|
man_set = set(man_paths)
|
|
|
|
failures = []
|
|
if len(man_paths) != len(man_set):
|
|
failures.append("manifest.files has duplicated paths")
|
|
missing = sorted(disk - man_set)
|
|
extra = sorted(man_set - disk)
|
|
if missing or extra:
|
|
failures.append("path-set mismatch: missing=%d extra=%d" % (len(missing), len(extra)))
|
|
if missing[:5]:
|
|
failures.append(" missing: %s" % missing[:5])
|
|
if extra[:5]:
|
|
failures.append(" extra: %s" % extra[:5])
|
|
|
|
if man.get("total_files") != len(disk):
|
|
failures.append("total_files %r != disk count %d" % (man.get("total_files"), len(disk)))
|
|
|
|
disk_cat = {}
|
|
for dirpath, dirnames, filenames in os.walk(ROOT):
|
|
for fn in filenames:
|
|
full = os.path.join(dirpath, fn)
|
|
try:
|
|
st = os.lstat(full)
|
|
except OSError:
|
|
continue
|
|
if stat.S_ISLNK(st.st_mode) or stat.S_ISSOCK(st.st_mode):
|
|
continue
|
|
rel = os.path.relpath(full, ROOT)
|
|
cat = classify(rel.split(os.sep), fn)
|
|
disk_cat[cat] = disk_cat.get(cat, 0) + 1
|
|
|
|
for c in CATEGORY_ORDER:
|
|
m, d = man.get("categories", {}).get(c), disk_cat.get(c, 0)
|
|
if m != d:
|
|
failures.append("category %s: manifest=%r recomputed=%d" % (c, m, d))
|
|
|
|
# Genuinely independent shell count of files on disk (no shared logic with
|
|
# the os.walk rules above) — the verdict anchor for the total-file claim.
|
|
t = subprocess.run(
|
|
["bash", "-c", "find %s -type f | wc -l" % ROOT], capture_output=True, text=True
|
|
)
|
|
shell_total = int(t.stdout.strip() or 0)
|
|
print("shell_total=%d" % shell_total)
|
|
if shell_total != len(disk):
|
|
failures.append(
|
|
"independent find|wc -l total %r != os.walk counted %d"
|
|
% (shell_total, len(disk))
|
|
)
|
|
|
|
# Per-category cross-check by directly re-walking the disk with the same
|
|
# priority rules (checks (c) from the docstring) — all categories already
|
|
# matched, so no further category loop is needed here.
|
|
|
|
if not os.path.exists(REPORT):
|
|
failures.append("report missing: %s" % REPORT)
|
|
else:
|
|
if os.path.getsize(REPORT) == 0:
|
|
failures.append("report empty")
|
|
|
|
print("manifest=%s" % MANIFEST)
|
|
print("disk_files=%d" % len(disk))
|
|
for c in CATEGORY_ORDER:
|
|
print(" %-8s manifest=%-5d recomputed=%-5d" % (c, man.get("categories", {}).get(c, 0), disk_cat.get(c, 0)))
|
|
print("report_bytes=%d" % os.path.getsize(REPORT))
|
|
if failures:
|
|
print("FAIL")
|
|
for fl in failures:
|
|
print(" -", fl)
|
|
return 1
|
|
print("VERDICT OK: manifest and report match ground truth on disk")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|