feat(ops): verify release provenance evidence pairs

scripts/release_provenance_gate.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import re
 import shlex
@@ -18,6 +19,7 @@ if __package__ in {None, ""}:
 from trex_core.adapters.persistence.ops_checks import (
     collect_release_provenance,
     isolate_dirty_checkout_files,
+    load_observed_evidence,
 )
 
 _COMMAND_CLASSES = ("deploy", "recovery", "manual-stop", "manual-start", "recreate")
@@ -92,8 +94,7 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--phase", required=True, choices=("pre", "post"))
     parser.add_argument("--command-class", required=True, choices=_COMMAND_CLASSES)
     parser.add_argument("--checkout-dir", default=".")
-    parser.add_argument("--expected-oci-revision", required=True)
-    parser.add_argument("--image-digest", required=True)
+    parser.add_argument("--observed-evidence-file", required=True)
     parser.add_argument("--runtime-file", action="append", required=True)
     parser.add_argument("--broker-log-path", default="/tmp/trex-core.log")
     parser.add_argument("--capture-command", action="append", required=True)
@@ -102,6 +103,7 @@ def main(argv: list[str] | None = None) -> int:
     args = parser.parse_args(argv)
 
     try:
+        observed_evidence = load_observed_evidence(args.observed_evidence_file)
         capture_commands: dict[str, list[str]] = {}
         for raw in args.capture_command:
             key, command = _parse_capture_command(raw)
@@ -136,13 +138,12 @@ def main(argv: list[str] | None = None) -> int:
             operation_id=args.operation_id,
             phase=args.phase,
             checkout_dir=checkout,
-            expected_oci_revision=args.expected_oci_revision,
-            image_digest=args.image_digest,
+            observed_evidence=observed_evidence,
             runtime_files=args.runtime_file,
             capture_commands=capture_commands,
             broker_log_path=args.broker_log_path,
         )
-    except (RuntimeError, ValueError) as exc:
+    except (RuntimeError, TypeError, ValueError) as exc:
         parser.error(str(exc))
 
     output_dir.mkdir(parents=True, exist_ok=True)
@@ -162,10 +163,21 @@ def main(argv: list[str] | None = None) -> int:
         )
 
     # Exclusive create prevents a provenance record from being overwritten.
-    with output_path.open("x", encoding="utf-8") as fp:
-        fp.write(json.dumps(report, ensure_ascii=False, indent=2) + "\n")
+    record_bytes = (json.dumps(report, ensure_ascii=False, indent=2) + "\n").encode("utf-8")
+    with output_path.open("xb") as fp:
+        fp.write(record_bytes)
     output_path.chmod(0o444)
-    print(str(output_path))
+    print(
+        json.dumps(
+            {
+                "schema_version": 1,
+                "record_path": str(output_path.resolve()),
+                "record_sha256": hashlib.sha256(record_bytes).hexdigest(),
+                "gate_passed": bool(report["gate"]["passed"]),
+            },
+            separators=(",", ":"),
+        )
+    )
     if dirty_checkout:
         return 2
     return 0 if report["gate"]["passed"] else 1

scripts/verify_release_provenance_pair.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""Verify one explicit release-provenance PRE/POST pair."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+if __package__ in {None, ""}:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from trex_core.adapters.persistence.ops_checks import verify_release_provenance_pair
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--pre-record", required=True)
+    parser.add_argument("--pre-sha256", required=True)
+    parser.add_argument("--post-record", required=True)
+    parser.add_argument("--post-sha256", required=True)
+    parser.add_argument("--output", required=True)
+    args = parser.parse_args(argv)
+
+    try:
+        manifest = verify_release_provenance_pair(
+            pre_path=args.pre_record,
+            pre_sha256=args.pre_sha256,
+            post_path=args.post_record,
+            post_sha256=args.post_sha256,
+            output_path=args.output,
+        )
+    except (OSError, TypeError, ValueError) as exc:
+        parser.error(str(exc))
+    print(
+        json.dumps(
+            {
+                "schema_version": 1,
+                "manifest_path": str(Path(args.output).resolve()),
+                "operation_id": manifest["operation_id"],
+            },
+            separators=(",", ":"),
+        )
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())