feat(ops): verify release provenance evidence pairs

scripts/verify_release_provenance_pair.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""Verify one explicit release-provenance PRE/POST pair."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+if __package__ in {None, ""}:
+    sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from trex_core.adapters.persistence.ops_checks import verify_release_provenance_pair
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--pre-record", required=True)
+    parser.add_argument("--pre-sha256", required=True)
+    parser.add_argument("--post-record", required=True)
+    parser.add_argument("--post-sha256", required=True)
+    parser.add_argument("--output", required=True)
+    args = parser.parse_args(argv)
+
+    try:
+        manifest = verify_release_provenance_pair(
+            pre_path=args.pre_record,
+            pre_sha256=args.pre_sha256,
+            post_path=args.post_record,
+            post_sha256=args.post_sha256,
+            output_path=args.output,
+        )
+    except (OSError, TypeError, ValueError) as exc:
+        parser.error(str(exc))
+    print(
+        json.dumps(
+            {
+                "schema_version": 1,
+                "manifest_path": str(Path(args.output).resolve()),
+                "operation_id": manifest["operation_id"],
+            },
+            separators=(",", ":"),
+        )
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())