软件加固交付证据怎样设定保留、校验和销毁规则

import datetime as dt
import hashlib
import json
import sys
from pathlib import Path

if len(sys.argv) != 3:
    raise SystemExit('usage: validate_evidence.py candidate.bin evidence-index.json')
candidate_path = Path(sys.argv[1])
index_path = Path(sys.argv[2])
if not candidate_path.is_file() or not index_path.is_file():
    raise SystemExit('candidate or index is missing')
base = index_path.resolve().parent
candidate_digest = hashlib.sha256(candidate_path.read_bytes()).hexdigest()
data = json.loads(index_path.read_text(encoding='utf-8'))
if data.get('candidate_sha256', '').lower() != candidate_digest:
    raise SystemExit('index does not bind the candidate')
entries = data.get('entries')
if not isinstance(entries, list) or not entries:
    raise SystemExit('evidence entries are missing')
allowed_access = {'public', 'internal', 'restricted', 'highly-restricted'}
seen = set()
today = dt.date.today()
for entry in entries:
    evidence_id = str(entry.get('evidence_id', '')).strip()
    if not evidence_id or evidence_id in seen:
        raise SystemExit('invalid or duplicate evidence id')
    seen.add(evidence_id)
    if entry.get('candidate_sha256', '').lower() != candidate_digest:
        raise SystemExit(f'{evidence_id}: candidate mismatch')
    if entry.get('access_class') not in allowed_access:
        raise SystemExit(f'{evidence_id}: invalid access class')
    try:
        retain_until = dt.date.fromisoformat(entry.get('retain_until', ''))
    except ValueError:
        raise SystemExit(f'{evidence_id}: invalid retention date')
    status = entry.get('status')
    relative = Path(str(entry.get('path', '')))
    target = (base / relative).resolve()
    if base not in target.parents:
        raise SystemExit(f'{evidence_id}: unsafe evidence path')
    if status == 'active':
        if retain_until < today or not target.is_file():
            raise SystemExit(f'{evidence_id}: active evidence is expired or missing')
        digest = hashlib.sha256(target.read_bytes()).hexdigest()
        if digest != entry.get('evidence_sha256', '').lower():
            raise SystemExit(f'{evidence_id}: evidence digest mismatch')
    elif status == 'destroyed':
        if target.exists():
            raise SystemExit(f'{evidence_id}: destroyed evidence still exists')
        receipt = (base / str(entry.get('destruction_receipt_path', ''))).resolve()
        if base not in receipt.parents or not receipt.is_file():
            raise SystemExit(f'{evidence_id}: destruction receipt is missing')
        receipt_digest = hashlib.sha256(receipt.read_bytes()).hexdigest()
        if receipt_digest != entry.get('destruction_receipt_sha256', '').lower():
            raise SystemExit(f'{evidence_id}: destruction receipt mismatch')
    else:
        raise SystemExit(f'{evidence_id}: unsupported status')
print(json.dumps({'candidate_sha256': candidate_digest, 'entries': len(entries), 'status': 'pass'}))