软件加固选云端还是本地化交付：先把数据、密钥和证据边界画清

import json
import sys
from pathlib import Path

REQUIRED_FIELDS = {
    'name',
    'mode',
    'dataClass',
    'processingBoundary',
    'signingLocation',
    'logsPolicy',
    'provenance',
    'exitPlan',
    'controls',
}
ALLOWED_MODES = {'managed-cloud', 'on-premises'}
ALLOWED_DATA = {'public', 'internal', 'confidential', 'restricted'}
SENSITIVE_FIELDS = {'privateKey', 'token', 'password', 'customerData'}

def fail(message):
    raise SystemExit(message)

def validate_option(option, index):
    if not isinstance(option, dict):
        fail(f'option {index} is not an object')
    leaked = SENSITIVE_FIELDS.intersection(option)
    if leaked:
        fail(f'option {index} contains forbidden fields: {sorted(leaked)}')
    missing = sorted(REQUIRED_FIELDS - option.keys())
    if missing:
        fail(f'option {index} lacks fields: {missing}')
    if option['mode'] not in ALLOWED_MODES:
        fail(f"option {index} has invalid mode")
    if option['dataClass'] not in ALLOWED_DATA:
        fail(f"option {index} has invalid data class")
    controls = option['controls']
    if not isinstance(controls, list) or not controls:
        fail(f'option {index} has no controls')
    if len(controls) != len(set(controls)):
        fail(f'option {index} repeats a control')
    boundary = str(option['processingBoundary']).strip()
    if not boundary:
        fail(f'option {index} has no processing boundary')
    signing = str(option['signingLocation']).strip().lower()
    if signing in {'external-private-key', 'uploaded-private-key'}:
        fail(f'option {index} externalizes a production private key')
    if option['mode'] == 'managed-cloud':
        if option['dataClass'] == 'restricted' and 'external-processing-approved' not in controls:
            fail(f'option {index} sends restricted data without approval')
        if 'tenant-isolation-reviewed' not in controls:
            fail(f'option {index} lacks tenant isolation review')
    if option['mode'] == 'on-premises':
        if 'host-baseline-owned' not in controls:
            fail(f'option {index} has no host baseline owner')
        if 'update-path-verified' not in controls:
            fail(f'option {index} has no verified update path')
    for field in ('logsPolicy', 'provenance', 'exitPlan'):
        if not str(option[field]).strip():
            fail(f'option {index} has an empty {field}')
    return {'name': option['name'], 'mode': option['mode'], 'status': 'pass'}

if len(sys.argv) != 2:
    fail('usage: validate_delivery.py decision.json')
source = Path(sys.argv[1])
if not source.is_file():
    raise SystemExit('decision file is missing')
data = json.loads(source.read_text(encoding='utf-8'))
options = data.get('options')
if not isinstance(options, list) or not options:
    fail('options array is missing')
results = [validate_option(option, index) for index, option in enumerate(options)]
print(json.dumps({'checked': len(results), 'results': results}, ensure_ascii=False))