65 lines
3.3 KiB
Python
65 lines
3.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Verify VM inputs and install small helper tools into the VM workspace only."""
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import subprocess
|
|
import urllib.request
|
|
import zipfile
|
|
|
|
root = Path(os.environ.get('DOCVIEW_VM_WORK', 'build-ubuntu-vm')).resolve()
|
|
downloads = root / 'downloads'
|
|
keyring = root / 'private/gnupg'
|
|
keyring.mkdir(mode=0o700, parents=True, exist_ok=True)
|
|
fingerprint = 'D2EB44626FDDC30B513D5BB71A5D6C4C7DB87C81'
|
|
|
|
|
|
def run(command, log):
|
|
result = subprocess.run(command, capture_output=True, text=True)
|
|
(root / 'logs' / log).write_text(result.stdout + result.stderr)
|
|
result.check_returncode()
|
|
return result.stdout + result.stderr
|
|
|
|
|
|
run(['gpg', '--homedir', str(keyring), '--batch', '--import',
|
|
str(downloads / 'ubuntu-cloud-key.asc')], 'ubuntu-key-import.txt')
|
|
identity = run(['gpg', '--homedir', str(keyring), '--batch', '--with-colons',
|
|
'--fingerprint'], 'ubuntu-key-fingerprint.txt')
|
|
assert 'fpr:::::::::' + fingerprint + ':' in identity
|
|
verification = run(['gpg', '--homedir', str(keyring), '--batch', '--status-fd', '1',
|
|
'--verify', str(downloads / 'SHA256SUMS.gpg'),
|
|
str(downloads / 'SHA256SUMS')], 'ubuntu-sha-signature.txt')
|
|
assert 'VALIDSIG ' + fingerprint + ' ' in verification
|
|
filename = 'noble-server-cloudimg-amd64.img'
|
|
expected = next(line.split()[0] for line in (downloads / 'SHA256SUMS').read_text().splitlines()
|
|
if line.split()[1].lstrip('*') == filename)
|
|
with (downloads / filename).open('rb') as stream:
|
|
actual = hashlib.file_digest(stream, 'sha256').hexdigest()
|
|
assert actual == expected
|
|
qemu = downloads / 'qemu-img-11.1.1-2-x86_64.pkg.tar.zst'
|
|
with qemu.open('rb') as stream:
|
|
assert hashlib.file_digest(stream, 'sha256').hexdigest() == 'a095493f3fffa82cc5db3a8409950124e67e45cb6ca30456a5851362be5c396a'
|
|
# This host-only bootstrap recipe was tested on Arch. Its trusted repository
|
|
# keyring is read-only; an Ubuntu guest does not use this host package.
|
|
run(['gpgv', '--keyring', '/etc/pacman.d/gnupg/pubring.gpg', str(qemu) + '.sig',
|
|
str(qemu)], 'qemu-package-signature.txt')
|
|
subprocess.run(['bsdtar', '-xf', str(qemu), '-C', str(root / 'tools'),
|
|
'usr/bin/qemu-img'], check=True)
|
|
package = json.loads((downloads / 'pycdlib.json').read_text())
|
|
wheel = next(item for item in package['urls'] if item['filename'].endswith('.whl'))
|
|
target = downloads / wheel['filename']
|
|
if not target.exists():
|
|
with urllib.request.urlopen(wheel['url'], timeout=45) as response:
|
|
target.write_bytes(response.read(300000))
|
|
with target.open('rb') as stream:
|
|
assert hashlib.file_digest(stream, 'sha256').hexdigest() == wheel['digests']['sha256']
|
|
assert target.stat().st_size == wheel['size']
|
|
with zipfile.ZipFile(target) as archive:
|
|
archive.extractall(root / 'tools/python')
|
|
report = {'ubuntuImageSignatureValid': True, 'ubuntuSigningFingerprint': fingerprint,
|
|
'ubuntuImageSha256': actual, 'ubuntuImageSize': (downloads / filename).stat().st_size,
|
|
'qemuPackageSha256MatchesLocalRepositoryDatabase': True, 'qemuPackageSignatureValid': True}
|
|
(root / 'metadata/verification.json').write_text(json.dumps(report, indent=2) + '\n')
|
|
print('Verified Ubuntu signed checksum/image, QEMU package and local ISO helper.')
|