软件加固交付给发布团队时怎样避免候选包错配

#!/usr/bin/env python3
import hashlib
import json
import re
import shutil
import subprocess
import sys
from pathlib import Path

SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
CERT_RE = re.compile(r"Signer #\d+ certificate SHA-256 digest:\s*([0-9a-fA-F]+)")

def fail(message, code=2):
    print(message, file=sys.stderr)
    raise SystemExit(code)

def sha256_file(path):
    digest = hashlib.sha256()
    with path.open("rb") as handle:
        for block in iter(lambda: handle.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()

def load_json(path, label):
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
        fail("cannot read " + label + ": " + str(exc))
    if not isinstance(value, dict):
        fail(label + " must be a JSON object")
    return value

def require_text(record, field, label):
    value = record.get(field)
    if not isinstance(value, str) or not value.strip():
        fail(label + " is missing " + field)
    return value.strip()

def run_tool(command, label):
    completed = subprocess.run(
        command,
        check=False,
        capture_output=True,
        text=True,
        encoding="utf-8",
        errors="replace",
        timeout=45,
    )
    if completed.returncode != 0:
        fail(label + " failed: " + completed.stderr.strip(), 10)
    return completed.stdout.strip()

def apkanalyzer_value(apkanalyzer, apk, field):
    return run_tool([apkanalyzer, "manifest", field, str(apk)], "apkanalyzer " + field).splitlines()[-1].strip()

def inspect_apk(apksigner, apkanalyzer, apk):
    verify_output = run_tool([apksigner, "verify", "--verbose", "--print-certs", str(apk)], "apksigner verify")
    certificates = sorted({match.lower() for match in CERT_RE.findall(verify_output)})
    if not certificates:
        fail("apksigner returned no certificate SHA-256 digest", 11)
    return {
        "artifactSha256": sha256_file(apk),
        "packageName": apkanalyzer_value(apkanalyzer, apk, "application-id"),
        "versionCode": apkanalyzer_value(apkanalyzer, apk, "version-code"),
        "versionName": apkanalyzer_value(apkanalyzer, apk, "version-name"),
        "certificateSha256s": certificates,
        "signatureOutputSha256": hashlib.sha256(verify_output.encode("utf-8")).hexdigest(),
    }

def resolve_under(root, relative, label):
    candidate = (root / relative).resolve()
    try:
        candidate.relative_to(root.resolve())
    except ValueError:
        fail(label + " escapes manifest directory")
    if not candidate.is_file():
        fail(label + " does not exist")
    return candidate

def validate_attestations(manifest, root, artifact_sha, findings):
    records = manifest.get("attestations")
    if not isinstance(records, list) or not records:
        fail("attestations must be a non-empty array")
    for index, record in enumerate(records):
        label = "attestation[" + str(index) + "]"
        if not isinstance(record, dict):
            fail(label + " must be an object")
        relative = require_text(record, "path", label)
        expected_file_sha = require_text(record, "sha256", label).lower()
        expected_type = require_text(record, "predicateType", label)
        if not SHA256_RE.fullmatch(expected_file_sha):
            fail(label + " has invalid sha256")
        path = resolve_under(root, relative, label)
        if sha256_file(path) != expected_file_sha:
            findings.append({"kind": "attestation-file-hash-mismatch", "path": relative})
            continue
        statement = load_json(path, label)
        if statement.get("predicateType") != expected_type:
            findings.append({"kind": "predicate-type-mismatch", "path": relative})
        subjects = statement.get("subject", [])
        if not isinstance(subjects, list):
            fail(label + " subject must be an array")
        subject_hashes = {
            str(subject.get("digest", {}).get("sha256", "")).lower()
            for subject in subjects
            if isinstance(subject, dict)
        }
        if artifact_sha not in subject_hashes:
            findings.append({"kind": "attestation-subject-mismatch", "path": relative})

def compare_identity(expected, observed, findings):
    for field in ("artifactSha256", "packageName", "versionCode", "versionName"):
        expected_value = str(expected.get(field, "")).strip()
        if not expected_value:
            fail("release manifest is missing " + field)
        if expected_value != observed[field]:
            findings.append({"kind": "identity-mismatch", "field": field, "expected": expected_value, "observed": observed[field]})
    expected_certs = expected.get("certificateSha256s")
    if not isinstance(expected_certs, list) or not expected_certs:
        fail("certificateSha256s must be a non-empty array")
    normalized = sorted({str(item).lower() for item in expected_certs})
    if any(not SHA256_RE.fullmatch(item) for item in normalized):
        fail("certificateSha256s contains an invalid digest")
    if normalized != observed["certificateSha256s"]:
        findings.append({"kind": "certificate-set-mismatch", "expected": normalized, "observed": observed["certificateSha256s"]})

def main():
    if len(sys.argv) != 3:
        print("Usage: verify_release_handoff.py RELEASE_MANIFEST_JSON UPLOAD_APK", file=sys.stderr)
        raise SystemExit(2)
    manifest_path = Path(sys.argv[1])
    upload_apk = Path(sys.argv[2])
    if not manifest_path.is_file() or not upload_apk.is_file():
        print("release manifest and upload APK must exist", file=sys.stderr)
        raise SystemExit(2)
    apksigner = shutil.which("apksigner")
    apkanalyzer = shutil.which("apkanalyzer")
    if not apksigner or not apkanalyzer:
        fail("fixed Android apksigner and apkanalyzer tools are required", 3)
    manifest = load_json(manifest_path, "release manifest")
    observed = inspect_apk(apksigner, apkanalyzer, upload_apk)
    findings = []
    compare_identity(manifest, observed, findings)
    validate_attestations(manifest, manifest_path.parent, observed["artifactSha256"], findings)
    result = {
        "status": "identity-mismatch" if findings else "handoff-identity-passed",
        "manifestSha256": sha256_file(manifest_path),
        "observedIdentity": observed,
        "findings": findings,
        "boundary": "Identity matching does not prove compatibility, security, store approval, or public release.",
    }
    print(json.dumps(result, ensure_ascii=False, indent=2, sort_keys=True))
    if findings:
        raise SystemExit(20)

if __name__ == "__main__":
    main()