~jT2UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z dZded<d Zded <d d d Zded<ej$dZded<dZded<d!dZd"dZd#dZd$dZd%dZd%dZd&dZd'dZ d(dZddd d)dZd*dZd+dZ e!d k(r e"e y),zISeal and verify the minimal immutable candidate for workspace quarantine.) annotationsN)Path)Finalz(task26-workspace-quarantine-candidate-v1r_SCHEMAz3dualcoach-workspace-quarantine-candidate-binding-v1_BINDING_SCHEMAz3gateway/platforms/rehearsal_workspace_quarantine.pyzhermes_cli/rehearsal_reset.py)z0gateway.platforms.rehearsal_workspace_quarantinezhermes_cli.rehearsal_reset_MODULE_MEMBERSzD(?i)(bot[_-]?token|api[_-]?key|authorization:\\s*bearer|sk-[a-z0-9])_FORBIDDEN_SECRET_PATTERNzBhermes-dualcoach-rehearsal-reset = hermes_cli.rehearsal_reset:main _ENTRY_POINTcRtj|dddjdS)NT),:) sort_keys separators ensure_asciiutf-8)jsondumpsencodevalues =.omo/senpi-task/task26/seal_workspace_quarantine_candidate.py _canonicalrs$ ::et QU V ] ]^e ffcHtj|jSN)hashlibsha256 hexdigestrs r_sha256rs >>% * * ,,rc4t|jSr)r read_bytes)paths r _sha256_filer#"s 4??$ %%rcH|j||jdy)N) write_byteschmod)r"rs r _write_sealedr(&sUJJurc|j}|js2|jr"tj|j dk7rt |dy)N@ is not sealed)lstat is_symlinkis_dirstatS_IMODEst_modeAssertionErrorr"labelinfos r_assert_private_directoryr6+sK ::z&_binding_from_wheel..As(nVmF(// g0FGVms.0z6wheel closure contains a forbidden secret-shaped tokenschemamodules)rEcandidate_digestrF)zipfileZipFilesetnamelistrvaluesr2sortedreadr@r splitlinesitemsanyrrr) wheelarchivenamesmissing entry_pointsmodulemembermodule_sourcesrBrFdigests r_binding_from_wheelr[7sR  7G$$&'o,,./%7  #B6'?BS!TU U||$TU\\]de |668 8 !MN NM\MbMbMdeMd>66&',,v"66Mde nVdVkVkVmn n !YZ ZAOAUAUAWXAW~vv676?*AWX Z?w OP QF%6g VX_ __ fY s+B+E2E&AE2E,4E2& E22E;c |tj|jdtj|jd}ttrt|ts t dhd}t fd|Dr t dddk7r t d |jd d k7s|jd d k7r t d t|jd ts t d d d dd|d t|t|dS)Nrencodingz(preflight quarantine evidence is invalid>event_idreceipt_sha256pre_tree_digestrGpost_tree_digestc3^K|]$}tj|t &ywr) isinstancegetstr)rAkeyreceipts rrCz$_preflight_record..Ts' ME gt $Jud,CGHH M?TUU+E2GX  (_-H +_=  #7E9=H +, -F CF8L LD {{}) :4&ABBUD4@JJEJ{"I OOOuzz)L OOE<(u$//G1Du1LM$22Jx4H54PQ OOEJJu 4L Krc  |j}t|d|dz }t|d|dz |dz h}|dz }|dz }t|dt|dtj|j d }tj|j d }t |trt |ts td t|hd k7s|jd tk7r td |jd}t |trt|ttk7r tdttt|d}|jd|k7r td|jd tk7s|jd|k7r td|jddk7r td|jdt|j!k7r td|jd|k7r td|jd} t | tr$| t#|tt|ddk7r td|jd} | Vt | trt| hdk7r tdt%d | j'Ds td|jd!} t | trt| hd"k7r td#|t)| d$z } |j+| t| d%| d&t-| k7s | d'| j/j0k7r td(| d)t2k7r td*t5j6| 5} tj'D]d\}}| j9|}||t|k7rtd+|t:j=|j?ds[td,t2| j9d-j?djAvr td. ddd|jCd/Dchc]}|jEs|}}||k7r td0d1d2|t-|t-|t-| tGtd3S#1swYzxYwcc}w)4Nzcandidate rootrzcandidate artifactsrrwzcandidate manifestzcandidate bindingrr]zcandidate metadata is invalid>rErFrGrEz#candidate binding schema is invalidrFz%candidate binding modules are invalidrDrGz#candidate binding digest is invalidz$candidate manifest digest is invalidr|z!candidate binding path is invalidr}z!candidate binding hash is invalidz#candidate module binding is invalidr~rrxz#candidate active closure is invalidr>r_rjr`rGrlrirkz'candidate preflight evidence is invalidc3nK|]-\}}|dk7s t|txrt|dk(/yw)r_@N)rdrfr)rArgrs rrCzverify..s8xQb:3fimwfw:eS)>c%jB.>>Qbs 5%5rR>r"rzrr{z#candidate wheel metadata is invalidr"zcandidate wheelrrzz!candidate wheel digest is invalidr{z candidate entry point is invalidz%candidate module differs from wheel: z:candidate closure contains a forbidden secret-shaped tokenr=z&candidate wheel entry point is invalid*zcandidate inventory is invalidz5task26-workspace-quarantine-candidate-verification-v1PASS)rEstatusrGcandidate_manifest_sha256r} wheel_sha256 module_count)$rr6r;rrmrnrdror2rJrerrrrrr!rMallrPrfaddr#r/st_sizer rHrIrNr r?r@rOrglobr9r)rrexpected_files manifest_path binding_pathrrrFrZclosurer wheel_info wheel_pathrSrWrXrBr" actual_filess rrrs <<>Dd$45{"Ii)>?66?U8UVN44M00L ';< &9:zz-1171CDHjj///ABG h %Z-F<== 7|@@GKKPXDY]lDlBCCkk)$G gt $G O8L(LDEE Z?w OP QF{{%&&0BCC||H(HLL9K,LPV,VCDD||,-1GG@AA||./7<;R;R;T3UU@AA||I')BCCll+,G w % gj12)*  BCC =>I)T*c)nA / !!JK KxQZQ`Q`Qbxx !JK Kg&J j$ '3z?>h+hBCCJv.//Jz" $56(|J77:g;NR\RaRaRcRkRk;k@AA- L0?@@  $-335NFF\\&)Fv'&/1$'LVH%UVV(// g0FG$%abb 6 w||,\]ddelmxxz z !IJ J { %&*ZZ_G_T D_LG~%=>>I"%1-%@$0$>$Z0O,  % $Hs 9A/S.)A S.S:&S:.S7c tj}|jdt|jdtttj j ddz dz |jdt|jd t|jd t|j} |jt|j}no|jRt|j|j|j|j }it|d t|i}n|jd t+t-j.dy#t t"t$t&j(f$r6}t+t-j.dt|ddYd}~yd}~wwxYw)Nz--wheel)typez--output-parentevidencetask26)rdefaultz--verifyz--preflight-receiptz--preflight-indexrcandidate_rootz&one of --wheel or --verify is requiredFAIL)rerrorT)rr8r)argparseArgumentParser add_argumentr__file__rr parse_argsrrRrrrrrfrr2rOSErrorrH BadZipFileprintrr)parserargsresultrexcs rmainrs  $ $ &F  -  X&&(003j@8K   . -D9 +$7    D ;; "DKK(F ZZ # """&"8"8 $ 4 4 D Ct B&6D BF LLA B $**Vt ,- OWg6H6H I djjFSX>$OPsBE::#G,GG__main__)robjectreturnrz)rrzrrf)r"rrrf)r"rrrzrNone)r"rr4rfrr)rRrrz(tuple[dict[str, object], dict[str, str]])rprrqrrdict[str, object])rrrRrrzdict[str, object] | Nonerr) rRrrrr Path | Nonerrrr)rrrr)rint)#__doc__ __future__rrrrrrer/rHpathlibrtypingrr__annotations__rrcompiler r rrr#r(r6r;r[rtrrrr__name__ SystemExitrrrs*O" ;;NN8m"A$.2::.u#v5vZ eZg-& 7 7 `">  ( D&*#' # ### # ! #  #LTn @ z TV r