extern/hishtory
1
0
Fork 0
mirror of https://github.com/ddworken/hishtory.git synced 2025-08-09 07:05:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add debugging information about subprocess errors when prevalidating releases

Browse Source
This commit is contained in:
David Dworken
2023-11-05 17:16:42 -08:00
parent 53d976811c
commit 3e31d022c8
1 changed files with 30 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
scripts/actions-validate.py
View File

@ -8,12 +8,12 @@ ALL_FILES = ['hishtory-linux-amd64', 'hishtory-linux-arm64', 'hishtory-darwin-am
def validate_slsa(hishtory_binary: str) -> None:
assert os.path.exists(hishtory_binary)
for filename in ALL_FILES:
try:
print(f"Validating {filename} with {hishtory_binary=}")
assert os.path.exists(filename)
slsa_attestation_file = filename + ".intoto.jsonl"
assert os.path.exists(slsa_attestation_file)
if "darwin" in filename:
continue # TODO: Enable SLSA validation for Mac binaries
unsigned_filename = f"{filename}-unsigned"
assert os.path.exists(unsigned_filename)
out = subprocess.check_output([
@ -33,7 +33,11 @@ def validate_slsa(hishtory_binary: str) -> None:
], stderr=subprocess.STDOUT).decode('utf-8')
assert "Verified signature against tlog entry" in out, out
assert "Verified build using builder" in out, out
except subprocess.CalledProcessError as e:
print(f"subprocess.CalledProcessError: stdout={repr(e.stdout)}")
if "darwin" in filename:
continue # TODO: Enable SLSA validation for Mac binaries
raise e
def validate_macos_signature(filename: str) -> None:
assert shutil.which('codesign') is not None