|ƂjS0 <dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl mZddlmZdZdZdZd Zd d d d dddddZGddeZd"dZd#dZd$dZd%dZd&dZd'dZd(dZd)dZd*dZ d+dZ!d,dZ"d-d Z#e$d!k(r e%e#y).zKCreate and verify the local immutable Task26 strict-rerun retention object.) annotationsN)Path)Anyz#task26-local-immutable-retention-v1z3root-owned-ext4-immutable-content-addressed-copy-v1lf@9f5d72840b4cc1fcb57720a61ebc53529fa00202d9201615e4ebdbb3e047a635@4a6c7ee54cf9526a30de8bb576c1d71b411938beba33a04914738f6e1b6ed1cb@fdcfb1efd1f2d4a2b95f22f7311827d197898a6d480cb572956e87bd66d20361@50e7556e58a876d8136fbfb2023ede8bcb46ac816d97d4b85e1d0559f463d008@84d937ef67c1517bfdbca4cabce9fb4bfbe39aa1165458bb3aedd14decc4bff0@188e9e630b53e9329ae185fc8c007aecb7988c16d174d325d68e8e004edb38e9z task26-current-4a6c7ee5-20260817)archive_root_sha256archive_entry_countcandidate_digestlifecycle_root_sha256lifecycle_seal_sha256v3_seal_sha256v4_seal_sha256run_idc eZdZy)RetentionErrorN)__name__ __module__ __qualname__}/home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-strict-rerun-retention-st_01a00ed5/retention_control.pyrr#srrcTtj|dddzjS)NT),:) sort_keys separators )jsondumpsencode)values rcanonr('s# JJu Dt K S S UUrcHtj|jSN)hashlibsha256 hexdigest)raws rshar/+s >>#  ( ( **rc4t|jSr*)r/ read_bytes)paths rfile_shar3/s t !!rc tj|tjtjzt tddz} t d}t j|t|dttj|dtztj|S#tj|wxYw)N O_NOFOLLOWrTlittle)osopenO_RDONLY O_CLOEXECgetattr bytearrayfcntlioctlFS_IOC_GETFLAGSboolint from_bytesFS_IMMUTABLE_FLclose)r2fdflagss r immutablerH3s| r{{R\\1GB a4PP QB!  B5CNN5(3oEF   s A B++Cc g}tj|dD]3\}}}|j|j|D]}t||z }|j }t j |jstd||j|j|jdt j|jdd|D]c}t||z }|j }t j|jr|jdk7rtd||j}|j } |j |j"|j$|j&|j(f| j | j"| j$| j&| j(fk7rtd ||j|j|jd t j|jdt+|t-|d f6|S) NF) followlinksznon-directory archive entry: D04o)r2typemodezunsafe archive file: zarchive changed while reading: F)r2rMrNsizer,)r8walksortrlstatstatS_ISDIRst_moderappend relative_toas_posixS_IMODES_ISREGst_nlinkr1st_devst_inost_size st_mtime_ns st_ctime_nslenr/) rootrowsbasedirsfilesnamer2str.afters rsource_inventoryrl=s!#DWWTu==dE  D:$DB<< +$'DTF%KLL KK!1!1$!7!@!@!BC\`\h\hikisis\tux[y{ |  D:$DB<< +r{{a/?$'6 Krc |Dcgc]}dDcic] }||vs|||c}}}}tt|Scc}wcc}}w)N)r2rMrNr,)r/r()rerowkey sealed_rowss rinventory_rootrq]saC#ES"D3s c#h"DS u[! "" Ts A = = AAc"|js|js tdt|tdk7r tdt|tdk7r tdt j |j}dD],}|j|t|k7std|dt|}t|td k7st|td k7r td t j |d z j}|jd i}dD],}|j|t|k7std|d|jdtdk7r td|S)Nz&source archive is not a real directoryrzv3 seal hash mismatchrzv4 seal hash mismatch)rrrzv3 seal mismatchrrz!source archive inventory mismatchz manifest.jsonbindings)rrrzarchive manifest rzarchive run_id mismatch) is_symlinkis_dirrr3EXPECTEDr$loadsr1getrlrcrq)sourcev3_sealv4_sealsealroremanifestrts rvalidate_sourceresp &--/EFFH%566455H%566455 ::g((* +DQ 88C=HSM ) 8C5 !:; ;R F #D 4yH233~d7KxXmOn7n@AAzz6O3??ABH||J+HU <<  - #4SE!CD DV||H(!33677 Krc|j}ddddddddd |d |d d d g}tj|ddd}|jdk7r3t d|jd|j j y)Nz/usr/bin/dockerrunz--rmz--pullneverz --networknonez --privilegedz-vz :/retentionshz-ceuzfind /retention -xdev -type f -exec chmod 0444 {} +; find /retention -xdev -depth -type d -exec chmod 0555 {} +; chown -R 0:0 /retention; find /retention -xdev -type f -exec chattr +i {} +; find /retention -xdev -depth -type d -exec chattr +i {} +TF)textcapture_outputcheckrzimmutable seal failed (z): )resolve subprocessr returncoderstderrstrip) object_dirimagecommandresults rseal_with_dockerr}s##%J5&(G[&R`  K(%v DG^^G$t5 QF A6v7H7H6IV]]M`M`MbLcdeerc t|j|j|j}|jdz }|t dz }|j rt|dz |dz S|jdddttjd|} |d z }tj|j|d tj |D]+}tj ||d z t#|d d-t%|}||k7r t'didt(dddt*dt ddt ddt ddt ddt ddt ddt ddt ddt dddd d!d"d#d$|}t-|} |d%z j/| d&d't*t dt1| t dt dt d|d d( } |dz j/t-| tj2||t5||j6t|dz |dz S#t8$r'|j rtj:|wxYw))Nobjectsrzretention-proof.jsonTi)parentsexist_okrNz.pending-retention-)prefixdirarchiveF)symlinks copy_functionr2rNz4copied archive is not byte/mode exact before sealingschemastatus RETAIN_UNTIL mechanism object_idsource_archive_root_sha256source_archive_entry_countrrrrrrrretention_started_utcz2026-08-17T00:00:00Zretain_until_utc2033-08-17T00:00:00Zretention_basisz.strict-rerun-audit-and-incident-reconstructionarchive_objectsretention-metadata.json)task26-local-immutable-retention-proof-v1SEALED rrrrmetadata_sha256rrrr)rrzr{r|storerwexistsverifymkdirrtempfilemkdtempshutilcopytreecopyfiler8chmodrBrlrSCHEMA MECHANISMr( write_bytesr/renamer docker_image Exceptionrmtree) argsrerfinalstagerrncopiedmetadata metadata_rawproofs rcreaters 4;; dll CDjj9$G h45 5E ||~u--.--- MM$EM: !!)>GL ME/)# WuFOO\C HHWs6{*CF Q,? @!'* T> !WX X f n    "78  )(3H*I  )(3H*I   ); <  $X.E%F  $X.E%F  h'78  h'78  hx(  $%;   6  O t! $X * *77 EA"!"78"<0 (); <%-.E%F%-.E%F (); <   ' '44U5\B % 1 12u--.---  <<> MM%  s F,I 0I<c |j}tj|j}|dz j}tj|}ddtt dt |t dt dt ddd }||k7r td |jd tk7s|jd tk7r td dD],}|j|t |k7std|d|jd}t|tr*t|t dk7st|t dk7r td|Dchc]}|d } }t|dz Dchc]}|d } }| | k7r td|D]X}|dz |dz } |ddk(s| jj |dk7st#| |dk7sItd|dd} t%j&|D]\} }}||zD]}t)| |z } | j+}tj,|j.rdnd}|j0dk7s<|j2dk7s-tj4|j.|k7s t7| std| | d z } |j+}|j0dk7s-tj4|j.dk7s t7|s td!d"d#t d| d zt|Dcgc] }|ddk(s |c}d$Scc}wcc}wcc}w)%Nrrrrrrrrrzretention proof mismatchrrz$retention metadata contract mismatch)rrrrrrzretention metadata rsrrz+retention object inventory binding mismatchr2rz"retention object path set mismatchrMrPrQr,z retention object hash mismatch: rimi$z&retention prevention control missing: rOz1retention object root is not root-owned immutablez0task26-local-immutable-retention-verification-v1PASS)rrrchecked_inodesverified_reads)parentr$rxr1rrwr/rryr isinstancelistrcrqrlrUr`r3r8rRrrTrVrWst_uidst_gidr[rH) proof_pathrrrrexpected_proofrorernexpected_paths actual_pathsr2checkedrfrgrhrirj required_moderoot_strs rrrs""J JJz,,. /E!::FFHLzz,'H=34|,$%78!)*A!B!)*A!B2 N 788||H'8<< +D +QCDDD <<  - #6se9!EF FD <<) *D dD !SY(;P2Q%QUcdhUimuwLnMVMJKK-12Tcc&kTN2+;J *NC~~h'H )$> Hrctj} |jdk(r%t|}t |}t ||d<nt |j }tt|jdy#ttttttj f$r(}td|t"j$Yd}~yd}~wwxYw) Nrr)endrz BLOCKED: )file)r parse_argsrrrstrrprintr(decoderOSError ValueErrorKeyError TypeErrorr$JSONDecodeErrorsysr)rrrexcs rmainrs 8   D  <<8 #4LEE]F!%jF7ODJJ'F eFm""$"- GZ9dFZFZ [ #cjj1sA-B-C5CC__main__)r'rreturnbytes)r.rrr)r2rrr)r2rrrA)rdrrlist[dict[str, Any]])rerrr)rzrr{rr|rrr)rrrrrNone)rzargparse.Namespacerr)rrrzdict[str, Any])rzargparse.ArgumentParser)rrB)&__doc__ __future__rrr>r+r$r8rrUrrrpathlibrtypingrrrr@rDrw RuntimeErrorrr(r/r3rHrlrqrrrrrrr SystemExitrrrrsQ"    . A ]Z__XX0  \ V+"@#0 f 8v.gb     z TV r