软件加固项目结束后怎样撤权：账号、样本、日志和签名入口逐项收尾

import json
import re
import sys
from datetime import date
from pathlib import Path

REQUIRED = {
    'accessId',
    'subjectRef',
    'resourceRef',
    'permission',
    'expiresAt',
    'disposition',
    'status',
    'resourceOwner',
    'retentionOwner',
    'receiptRef',
}
FORBIDDEN = {'token', 'password', 'privateKey', 'customerData'}
DISPOSITIONS = {'revoke', 'transfer', 'retain-with-boundary'}
STATUSES = {'planned', 'blocked', 'active', 'completed'}
AMBIGUOUS = re.compile(r'^(both|joint|tbd|双方|共同负责|待定)$', re.I)

def stop(message):
    raise SystemExit(message)

def parse_day(value, field, index):
    try:
        return date.fromisoformat(str(value))
    except ValueError:
        stop(f'record {index} has invalid {field}')

def required_text(record, field, index):
    value = str(record[field]).strip()
    if not value:
        stop(f'record {index} has empty {field}')
    return value

def validate(record, index, offboarding_date):
    if not isinstance(record, dict):
        stop(f'record {index} is not an object')
    if FORBIDDEN.intersection(record):
        stop(f'record {index} contains forbidden fields')
    missing = sorted(REQUIRED - record.keys())
    if missing:
        stop(f'record {index} lacks fields: {missing}')
    disposition = record['disposition']
    status = record['status']
    if disposition not in DISPOSITIONS or status not in STATUSES:
        stop(f'record {index} has invalid disposition or status')
    owner = required_text(record, 'resourceOwner', index)
    if AMBIGUOUS.fullmatch(owner):
        stop(f'record {index} has ambiguous resource owner')
    expires = parse_day(record['expiresAt'], 'expiresAt', index)
    if status == 'active' and expires >= offboarding_date:
        stop(f'record {index} remains active after offboarding')
    if disposition == 'revoke' and status == 'completed':
        if not str(record['receiptRef']).strip():
            stop(f'record {index} is revoked without receipt')
    if disposition == 'transfer' and status == 'completed':
        required_text(record, 'resourceOwner', index)
    if disposition == 'retain-with-boundary':
        retention_owner = str(record['retentionOwner']).strip()
        if not retention_owner or AMBIGUOUS.fullmatch(retention_owner):
            stop(f'record {index} has no retention owner')
    identity = (required_text(record, 'subjectRef', index), required_text(record, 'resourceRef', index), required_text(record, 'permission', index))
    return required_text(record, 'accessId', index), identity

if len(sys.argv) != 2:
    stop('usage: validate_offboarding.py offboarding.json')
source = Path(sys.argv[1])
if not source.is_file():
    raise SystemExit('offboarding file is missing')
data = json.loads(source.read_text(encoding='utf-8'))
if not isinstance(data, dict):
    raise SystemExit('offboarding root must be an object')
offboarding_date = parse_day(data.get('offboardingDate'), 'offboardingDate', 'root')
records = data.get('access')
if not isinstance(records, list) or not records:
    raise SystemExit('access records are missing')
results = [validate(record, index, offboarding_date) for index, record in enumerate(records)]
access_ids = [item[0] for item in results]
identities = [item[1] for item in results]
if len(access_ids) != len(set(access_ids)):
    raise SystemExit('accessId is not unique')
if len(identities) != len(set(identities)):
    raise SystemExit('subject resource permission relation is duplicated')
print(json.dumps({'accessRecords': len(records), 'status': 'pass'}))