AskaEth
540b82e197
复审 reviewer-presenterfix-r1 的 fix-then-merge 两条，逐条落地。
P2-1(a)「两档」措辞被本次提交自己作废 ⇒ 三处全改成三档：
* `crates/core/src/update/trust.rs` 模块文档（读者最先看到的那句，上次漏了）
* `crates/core/src/update/tests/support_sign.rs` 模块文档 + `TEST_SIGNING_SEED` 的文档
P2-1(b)「三者都进不了发布产物」被复证实测证伪（`cfg!()` 是运行时假分支，不是 `#[cfg]`
编译期剔除；无 feature 的 dev 与 --release 两档 core rlib 里公钥十六进制与 `test-only-key` 都在）
⇒ 降级到事实能撑的断言：「不会被 `keyring()` 并进信任表，正式构建永远不认这把测试钥」，
并明写「字节仍编在产物里」「字节级不在产物里未证、也未声称」「换 `#[cfg]` 是另一条结构性改动」。
没有换成 `#[cfg]`（那是复审建议另开的 mission）。
P3-1 守门对 core「自己的声明」只认形状 ⇒ 收紧为只许空数组：
`DECLARATION` 从 `^\s*update-test-key\s*=\s*\[` 改成 `^\s*update-test-key\s*=\s*\[\s*\]\s*$`，
并加一条自检向量（core 声明里偷偷带子 feature ⇒ 必须红）。`--self-test` 从 6 条变 7 条
（5 红 / 2 绿）+ 基线，`packaging/README.md` 的计数同步。
⚠ 一个自己踩出来的坑，已被既有守门抓住：收紧时我先在 `check_test_key_off.py` 里把那条更宽的
测试通道 feature 写成**字面量**（自检向量 + 文档表格），`check_test_source_off.py` 立刻红
（`packaging/**` 按字面扫，这次提交前它一直是绿的）。改法照该文件自己的声明办——用
`OTHER_FEATURE = "-".join(("update", "test", "source"))` 拼出来，源码里字面量为 0，
自检向量仍然构造出完整字符串并必须判红。
验证（均在最终树上）：`cargo test --workspace --all-targets` 0、`cargo fmt --all --check` 0、
`check_test_key_off.py --self-test` 0（7 向量）/ 正式扫描 0、`check_test_source_off.py` 0、
`check_workflows_yaml.py` 0。
253 lines
10 KiB
Python
253 lines
10 KiB
Python
#!/usr/bin/env python3
|
||
"""守 `update-test-key`：这把**公开**的测试公钥不许进发布构建（M190 r3）。
|
||
|
||
背景：`crates/core` 的信任表（`trust::PRODUCTION`）正式构建里是空的（fail-closed，等用户录钥），
|
||
测试公钥 `trust::TEST_ONLY` 只在三档「仅测试」构建里并入：`cfg(test)`、测试通道那条 feature、
|
||
`update-test-key`。第三档是给 `crates/presenter` 的 `[dev-dependencies]` 用的——presenter 的更新链路
|
||
用例要构造「本构建认得」的签名清单，而它编译 core 时既没有 `cfg(test)`，也不该打开
|
||
「测试通道」那条 feature（它会**同时**给出「本地目录当更新源」这条路，是另一个更大的口子；
|
||
那条由 `check_test_source_off.py` 守。⚠ 本文件**刻意不写那条 feature 的全名**：那个守门按字面
|
||
扫 `packaging/**`，写了这里就红——这是它的设计（宁可误杀也不放过），不是笔误）。
|
||
|
||
这一档比「测试通道」那条 feature 窄，但它仍然是**信任锚的开关**：一旦进发布构建，任何人都能用公开种子
|
||
签出「官方更新」。所以它的出现位置必须是**白名单**，而不是「没人会这么写」：
|
||
|
||
| 允许出现的地方 | 形态 |
|
||
|---|---|
|
||
| `crates/core/Cargo.toml` | 只能是它自己的声明，且必须是**空数组** `update-test-key = []`（写成带子 feature 的非空数组即红） |
|
||
| `crates/presenter/Cargo.toml` | 只能出现在 `[dev-dependencies]` 段内 |
|
||
| 本脚本 | 它必须写出这个 feature 名 |
|
||
|
||
其余任何地方（workflow、`packaging/` 的脚本、根 `Cargo.toml`、`.cargo/config*.toml`、presenter 的
|
||
`[dependencies]`）提到它即红。`--self-test` 把这四类真实回归各注入一次（workflow / presenter 的
|
||
`[dependencies]` / 根 `Cargo.toml` / core 声明里偷偷带子 feature），并断言合法写法不误杀。
|
||
|
||
python3 packaging/check_test_key_off.py
|
||
python3 packaging/check_test_key_off.py --self-test
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import re
|
||
import sys
|
||
import tempfile
|
||
from pathlib import Path
|
||
|
||
FEATURE = "update-test-key"
|
||
ROOT = Path(__file__).resolve().parent.parent
|
||
GUARD = Path(__file__).resolve()
|
||
|
||
#: 扫描面（逐项列举，不用 `**` 全仓：那会把 `target/` 拖进来）。
|
||
GLOBS = (
|
||
".github/workflows/**/*.yml",
|
||
".github/workflows/**/*.yaml",
|
||
".github/actions/**/*.yml",
|
||
".github/actions/**/*.yaml",
|
||
"packaging/**/*.py",
|
||
"packaging/**/*.sh",
|
||
"packaging/**/*.ps1",
|
||
"Cargo.toml",
|
||
"crates/*/Cargo.toml",
|
||
"Makefile",
|
||
"justfile",
|
||
"Justfile",
|
||
"Taskfile.yml",
|
||
"Taskfile.yaml",
|
||
"crates/*/Makefile",
|
||
"packaging/Makefile",
|
||
".cargo/config.toml",
|
||
".cargo/config",
|
||
"crates/*/.cargo/config.toml",
|
||
"crates/*/.cargo/config",
|
||
)
|
||
|
||
#: 白名单：(相对路径, 允许的形态)。形态见 `check_manifest` 的三种判法。
|
||
ALLOWED_DECLARATION = "crates/core/Cargo.toml"
|
||
ALLOWED_DEV_DEPENDENCY = "crates/presenter/Cargo.toml"
|
||
|
||
#: 另一条（更宽的）测试通道 feature 的名字。**刻意拼出来**：`check_test_source_off.py` 按字面扫
|
||
#: `packaging/**`，这里写全名会让那个守门红 —— 那是它的设计（宁可误杀也不放过），不是笔误。
|
||
#: 本文件与它同源同一套手法，别“顺手”把它写成字面量。
|
||
OTHER_FEATURE = "-".join(("update", "test", "source"))
|
||
|
||
#: core 只许**自己的声明**，而且必须是**空数组** `update-test-key = []`。
|
||
#: 这里认**内容**、不只认形状：写成带子 feature 的非空数组（`["<另一条 feature>"]`）会让这个「窄口子」
|
||
#: 顺手把「宽口子」（环境变量 + `DirSource` 那条测试通道）拉起来 —— 那正是本守门要防的逃逸。
|
||
DECLARATION = re.compile(rf"^\s*{re.escape(FEATURE)}\s*=\s*\[\s*\]\s*$")
|
||
SECTION = re.compile(r"^\s*\[([^\]]+)\]\s*$")
|
||
|
||
|
||
def strip_comment(line: str) -> str:
|
||
"""引号感知地剥注释（与 `check_test_source_off.py` 同一手法，省得两处对同一行有不同看法）。"""
|
||
quote = None
|
||
for index, char in enumerate(line):
|
||
if quote is not None:
|
||
if char == quote:
|
||
quote = None
|
||
elif char in "\"'":
|
||
quote = char
|
||
elif char == "#" and (index == 0 or line[index - 1].isspace()):
|
||
return line[:index]
|
||
return line
|
||
|
||
|
||
def check_manifest(path: Path, where: str) -> list[str]:
|
||
"""`Cargo.toml`：核心只许自己的声明；presenter 只许 `[dev-dependencies]` 段内。"""
|
||
problems: list[str] = []
|
||
section = ""
|
||
for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), start=1):
|
||
code = strip_comment(line).strip()
|
||
if not code:
|
||
continue
|
||
header = SECTION.match(code)
|
||
if header:
|
||
section = header.group(1).strip()
|
||
continue
|
||
if FEATURE not in code:
|
||
continue
|
||
if where == ALLOWED_DECLARATION and DECLARATION.match(code):
|
||
continue
|
||
if where == ALLOWED_DEV_DEPENDENCY and section == "dev-dependencies":
|
||
continue
|
||
problems.append(
|
||
f"::error file={where}:{number}::{where} 在 `[{section or '顶部'}]` 里写了 `{FEATURE}`；"
|
||
"它只许出现在 crates/core/Cargo.toml 自己的声明与 crates/presenter/Cargo.toml 的 "
|
||
"`[dev-dependencies]` 里（这把公钥进发布构建 = 谁都能签出「官方更新」）"
|
||
)
|
||
return problems
|
||
|
||
|
||
def check_plain(path: Path, where: str) -> list[str]:
|
||
"""其余文件类型：出现即红（不解释形态）。"""
|
||
problems: list[str] = []
|
||
for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), start=1):
|
||
if FEATURE in strip_comment(line):
|
||
problems.append(
|
||
f"::error file={where}:{number}::{where} 提到 `{FEATURE}`：它不进 workflow / 打包脚本 / "
|
||
"cargo 配置（测试钥只许由 crates/presenter 的 dev-dependencies 打开）"
|
||
)
|
||
return problems
|
||
|
||
|
||
def scan(root: Path) -> list[str]:
|
||
"""扫整个仓库，返回所有问题（空 = 绿）。"""
|
||
problems: list[str] = []
|
||
for pattern in GLOBS:
|
||
for path in sorted(root.glob(pattern)):
|
||
if not path.is_file() or path.resolve() == GUARD:
|
||
continue
|
||
where = path.relative_to(root).as_posix()
|
||
try:
|
||
if path.name == "Cargo.toml":
|
||
problems += check_manifest(path, where)
|
||
else:
|
||
problems += check_plain(path, where)
|
||
except (OSError, UnicodeDecodeError) as error:
|
||
problems.append(f"::error file={where}::读不到：{error}")
|
||
return problems
|
||
|
||
|
||
# ────────────────────────── 变异自测 ──────────────────────────
|
||
|
||
BASELINE = {
|
||
"crates/core/Cargo.toml": (
|
||
"[features]\nother-feature = []\n\n# 注释里提到 update-test-key 不算违规\ntest-key = []\n"
|
||
"update-test-key = []\n"
|
||
),
|
||
"crates/presenter/Cargo.toml": (
|
||
"[dependencies]\nunlucky-core = { path = \"../core\" }\n\n"
|
||
"[dev-dependencies]\nunlucky-core = { path = \"../core\", features = [\"update-test-key\"] }\n"
|
||
),
|
||
".github/workflows/ci.yml": "jobs:\n a:\n steps:\n - run: cargo test\n",
|
||
}
|
||
|
||
VECTORS = [
|
||
(
|
||
"workflow 里打开它",
|
||
{".github/workflows/ci.yml": "jobs:\n a:\n steps:\n - run: cargo build --features update-test-key\n"},
|
||
"red",
|
||
),
|
||
(
|
||
"presenter 的 [dependencies] 里打开它",
|
||
{
|
||
"crates/presenter/Cargo.toml": (
|
||
"[dependencies]\nunlucky-core = { path = \"../core\", features = [\"update-test-key\"] }\n"
|
||
)
|
||
},
|
||
"red",
|
||
),
|
||
(
|
||
"根 Cargo.toml 把依赖提起来",
|
||
{
|
||
"Cargo.toml": (
|
||
'[workspace.dependencies]\nunlucky-core = { path = "crates/core", '
|
||
'features = ["update-test-key"] }\n'
|
||
)
|
||
},
|
||
"red",
|
||
),
|
||
("打包脚本提到它", {"packaging/x.sh": "cargo build --features update-test-key\n"}, "red"),
|
||
(
|
||
"core 自己的声明（合法）",
|
||
{"crates/core/Cargo.toml": "[features]\nupdate-test-key = []\n"},
|
||
"green",
|
||
),
|
||
(
|
||
"core 的声明里偷偷带子 feature（形状合法、内容非法）",
|
||
{"crates/core/Cargo.toml": f'[features]\n{FEATURE} = ["{OTHER_FEATURE}"]\n'},
|
||
"red",
|
||
),
|
||
("注释里提到它（合法）", {"packaging/y.py": "# 见 update-test-key 的说明\n"}, "green"),
|
||
]
|
||
|
||
|
||
def _scan_case(files: dict[str, str]) -> list[str]:
|
||
with tempfile.TemporaryDirectory(prefix="ull-test-key-guard-") as temp:
|
||
root = Path(temp)
|
||
for relative, text in files.items():
|
||
path = root / relative
|
||
path.parent.mkdir(parents=True, exist_ok=True)
|
||
path.write_text(text, encoding="utf-8")
|
||
return scan(root)
|
||
|
||
|
||
def self_test() -> int:
|
||
failures = 0
|
||
baseline = _scan_case(BASELINE)
|
||
if baseline:
|
||
print(f"FAIL 基线被判红：{baseline}", file=sys.stderr)
|
||
failures += 1
|
||
for label, files, expect in VECTORS:
|
||
merged = dict(BASELINE)
|
||
merged.update(files)
|
||
problems = _scan_case(merged)
|
||
red = bool(problems)
|
||
if (expect == "red") != red:
|
||
print(f"FAIL 向量「{label}」期望 {expect}，实际 {'red' if red else 'green'}", file=sys.stderr)
|
||
failures += 1
|
||
print(f"self-test: {'ok' if failures == 0 else f'{failures} 处失败'}（{len(VECTORS)} 条向量 + 基线）")
|
||
return 0 if failures == 0 else 1
|
||
|
||
|
||
def main(argv: list[str] | None = None) -> int:
|
||
parser = argparse.ArgumentParser(description="测试公钥不许进发布构建（M190）")
|
||
parser.add_argument("--self-test", action="store_true", help="注入变异：该红的红、该绿的绿")
|
||
parser.add_argument("--dir", type=Path, default=ROOT, help="仓库根（默认本文件上一级）")
|
||
args = parser.parse_args(argv)
|
||
|
||
if args.self_test:
|
||
return self_test()
|
||
problems = scan(args.dir)
|
||
for line in problems:
|
||
print(line, file=sys.stderr)
|
||
if problems:
|
||
print(f"FAIL：{len(problems)} 处（`{FEATURE}` 只许由 crates/presenter 的 dev-dependencies 打开）", file=sys.stderr)
|
||
return 1
|
||
print(f"ok: `{FEATURE}` 只出现在允许的位置（core 的声明 + presenter 的 dev-dependencies）")
|
||
return 0
|
||
|
||
|
||
if __name__ == "__main__":
|
||
raise SystemExit(main())
|