#!/usr/bin/env python3
|
"""Validate the mechanically bound source set for the generic article/image collector."""
|
|
from __future__ import annotations
|
|
import hashlib
|
import json
|
import os
|
import stat
|
import sys
|
from pathlib import Path
|
from typing import Any
|
|
|
PROJECT_ROOT = Path(__file__).resolve().parents[2]
|
DEFAULT_MANIFEST = Path(__file__).with_name("bili_article_image_source_manifest.json")
|
SHA256 = __import__("re").compile(r"[0-9A-F]{64}")
|
|
|
def _reparse(path: Path) -> bool:
|
info = path.lstat()
|
return stat.S_ISLNK(info.st_mode) or bool(getattr(info, "st_file_attributes", 0) & 0x400)
|
|
|
def _strict_json(path: Path) -> tuple[Any, bytes]:
|
raw = path.read_bytes()
|
if raw.startswith(b"\xef\xbb\xbf") or b"\r" in raw or not raw.endswith(b"\n") or raw.endswith(b"\n\n"):
|
raise ValueError("manifest encoding differs")
|
return json.loads(raw[:-1].decode("utf-8", errors="strict")), raw
|
|
|
def validate(manifest_path: Path = DEFAULT_MANIFEST) -> dict[str, Any]:
|
manifest_path = Path(os.path.abspath(manifest_path))
|
value, raw = _strict_json(manifest_path)
|
if not isinstance(value, dict) or set(value) != {"schema", "task_id", "scope", "root", "files", "tree_sha256"}:
|
raise ValueError("manifest schema differs")
|
if value["schema"] != 1 or value["task_id"] != "DEV-PROJECT-INFO-BILI-AUTHENTICATED-SESSION-DOWNLOAD-20260805-001" or value["scope"] != "generic-bilibili-article-image-collector-source":
|
raise ValueError("manifest identity differs")
|
root = (PROJECT_ROOT / value["root"]).resolve(strict=True)
|
if root != PROJECT_ROOT / "dev" / "project-dev" or _reparse(root):
|
raise ValueError("manifest root differs")
|
files = value["files"]
|
if not isinstance(files, list) or not files:
|
raise ValueError("manifest files differ")
|
seen: set[str] = set()
|
actual: list[dict[str, Any]] = []
|
for entry in files:
|
if not isinstance(entry, dict) or set(entry) != {"path", "bytes", "sha256"}:
|
raise ValueError("manifest entry schema differs")
|
relative = entry["path"]
|
if not isinstance(relative, str) or not relative or "\\" in relative or relative.startswith("/") or ".." in Path(relative).parts or relative in seen:
|
raise ValueError("manifest entry path differs")
|
seen.add(relative)
|
candidate = (root / Path(*relative.split("/"))).resolve(strict=True)
|
if candidate.parent == root and candidate == manifest_path:
|
raise ValueError("manifest cannot self-bind")
|
if not candidate.is_file() or _reparse(candidate):
|
raise ValueError("source file is missing or unsafe")
|
payload = candidate.read_bytes()
|
fact = {"path": relative, "bytes": len(payload), "sha256": hashlib.sha256(payload).hexdigest().upper()}
|
if entry != fact or SHA256.fullmatch(str(entry["sha256"])) is None:
|
raise ValueError("source file identity differs")
|
actual.append(fact)
|
material = bytearray()
|
for entry in sorted(actual, key=lambda item: item["path"]):
|
material.extend(entry["path"].encode("utf-8"))
|
material.extend(b"\0")
|
material.extend(str(entry["bytes"]).encode("ascii"))
|
material.extend(b"\0")
|
material.extend(entry["sha256"].encode("ascii"))
|
material.extend(b"\n")
|
tree = hashlib.sha256(material).hexdigest().upper()
|
if value["tree_sha256"] != tree:
|
raise ValueError("source tree identity differs")
|
return {
|
"schema_version": 1,
|
"status": "SOURCE_VALID",
|
"file_count": len(actual),
|
"tree_sha256": tree,
|
"manifest_bytes": len(raw),
|
"manifest_sha256": hashlib.sha256(raw).hexdigest().upper(),
|
"mutation_count": 0,
|
}
|
|
|
def main() -> int:
|
try:
|
result = validate()
|
code = 0
|
except Exception:
|
result = {"schema_version": 1, "status": "SOURCE_INVALID", "error_code": "E_SOURCE_IDENTITY", "mutation_count": 0}
|
code = 3
|
print(json.dumps(result, ensure_ascii=False, sort_keys=True, separators=(",", ":")))
|
return code
|
|
|
if __name__ == "__main__":
|
raise SystemExit(main())
|
