732642856
85 lines
3.1 KiB
Python
85 lines
3.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Archive reproducible VedAstro package identity and hosted-version gap."""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
from urllib.request import urlopen
|
|
|
|
|
|
REGISTRATION_URL = (
|
|
"https://api.nuget.org/v3/registration5-semver1/"
|
|
"vedastro.library/{version}.json"
|
|
)
|
|
|
|
|
|
def _json_url(url: str, timeout: float) -> dict:
|
|
with urlopen(url, timeout=timeout) as response: # noqa: S310 - fixed public NuGet URL.
|
|
return json.loads(response.read().decode("utf-8"))
|
|
|
|
|
|
def build_archive(version: str = "1.2.0", timeout: float = 20.0) -> dict:
|
|
registration = _json_url(REGISTRATION_URL.format(version=version), timeout)
|
|
catalog_url = registration["catalogEntry"]
|
|
catalog = _json_url(catalog_url, timeout)
|
|
deps = []
|
|
for group in catalog.get("dependencyGroups") or []:
|
|
target = group.get("targetFramework")
|
|
for dep in group.get("dependencies") or []:
|
|
deps.append(
|
|
{
|
|
"target_framework": target,
|
|
"id": dep["id"],
|
|
"range": dep["range"],
|
|
}
|
|
)
|
|
|
|
return {
|
|
"scope": "vedastro_reproducible_identity_archive",
|
|
"package": "VedAstro.Library",
|
|
"version": version,
|
|
"nuget_registration_url": REGISTRATION_URL.format(version=version),
|
|
"nuget_catalog_url": catalog_url,
|
|
"package_content_url": registration["packageContent"],
|
|
"package_hash_algorithm": catalog.get("packageHashAlgorithm"),
|
|
"package_hash": catalog.get("packageHash"),
|
|
"package_size": catalog.get("packageSize"),
|
|
"published": catalog.get("published") or registration.get("published"),
|
|
"catalog_commit_id": catalog.get("catalog:commitId"),
|
|
"catalog_commit_timestamp": catalog.get("catalog:commitTimeStamp"),
|
|
"license": catalog.get("licenseExpression"),
|
|
"project_url": catalog.get("projectUrl"),
|
|
"dependencies": deps,
|
|
"self_host_candidate_status": "reproducible_package_identity_archived",
|
|
"hosted_api_status": "blocked",
|
|
"hosted_api_blocker": (
|
|
"api.vedastro.org does not expose a verified build commit, package hash, "
|
|
"DLL hash, assembly version, container digest, or method-semantics contract."
|
|
),
|
|
"boundary": (
|
|
"This archive fixes a NuGet self-host candidate identity only; it does not "
|
|
"prove the hosted API is running this package or the same method semantics."
|
|
),
|
|
}
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--version", default="1.2.0")
|
|
parser.add_argument("--timeout", type=float, default=20.0)
|
|
parser.add_argument("--output", type=Path)
|
|
args = parser.parse_args()
|
|
report = build_archive(args.version, args.timeout)
|
|
text = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + "\n"
|
|
if args.output:
|
|
args.output.parent.mkdir(parents=True, exist_ok=True)
|
|
args.output.write_text(text, encoding="utf-8")
|
|
sys.stdout.write(text)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|