extern/hishtory
1
0
Fork 0
mirror of https://github.com/ddworken/hishtory.git synced 2025-08-09 07:05:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add debugging information about subprocess errors when prevalidating releases

Browse Source
This commit is contained in:
David Dworken
2023-11-05 17:16:42 -08:00
parent 53d976811c
commit 3e31d022c8
1 changed files with 30 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
scripts/actions-validate.py
View File

@ -8,32 +8,36 @@ ALL_FILES = ['hishtory-linux-amd64', 'hishtory-linux-arm64', 'hishtory-darwin-am
def validate_slsa(hishtory_binary: str) -> None: def validate_slsa(hishtory_binary: str) -> None:
assert os.path.exists(hishtory_binary) assert os.path.exists(hishtory_binary)
for filename in ALL_FILES: for filename in ALL_FILES:
print(f"Validating {filename} with {hishtory_binary=}") try:
assert os.path.exists(filename) print(f"Validating {filename} with {hishtory_binary=}")
slsa_attestation_file = filename + ".intoto.jsonl" assert os.path.exists(filename)
assert os.path.exists(slsa_attestation_file) slsa_attestation_file = filename + ".intoto.jsonl"
if "darwin" in filename: assert os.path.exists(slsa_attestation_file)
continue # TODO: Enable SLSA validation for Mac binaries if "darwin" in filename:
unsigned_filename = f"{filename}-unsigned" unsigned_filename = f"{filename}-unsigned"
assert os.path.exists(unsigned_filename) assert os.path.exists(unsigned_filename)
out = subprocess.check_output([ out = subprocess.check_output([
hishtory_binary, hishtory_binary,
"validate-binary", "validate-binary",
filename, filename,
slsa_attestation_file, slsa_attestation_file,
"--is_macos=True", "--is_macos=True",
f"--macos_unsigned_binary={unsigned_filename}" f"--macos_unsigned_binary={unsigned_filename}"
], stderr=subprocess.STDOUT).decode('utf-8') ], stderr=subprocess.STDOUT).decode('utf-8')
else: else:
out = subprocess.check_output([ out = subprocess.check_output([
hishtory_binary, hishtory_binary,
"validate-binary", "validate-binary",
filename, filename,
slsa_attestation_file slsa_attestation_file
], stderr=subprocess.STDOUT).decode('utf-8') ], stderr=subprocess.STDOUT).decode('utf-8')
assert "Verified signature against tlog entry" in out, out assert "Verified signature against tlog entry" in out, out
assert "Verified build using builder" in out, out assert "Verified build using builder" in out, out
except subprocess.CalledProcessError as e:
print(f"subprocess.CalledProcessError: stdout={repr(e.stdout)}")
if "darwin" in filename:
continue # TODO: Enable SLSA validation for Mac binaries
raise e
def validate_macos_signature(filename: str) -> None: def validate_macos_signature(filename: str) -> None:
assert shutil.which('codesign') is not None assert shutil.which('codesign') is not None