软件加固 SOW 怎么写：把交付物、验收证据和责任边界落到候选包

import json
import re
import sys
from pathlib import Path

REQUIRED_ROOT = {
    'title',
    'approver',
    'deliverables',
    'changeControl',
    'exitConditions',
}
REQUIRED_ITEM = {
    'id',
    'owner',
    'artifactRef',
    'acceptanceEvidence',
    'exclusions',
    'status',
}
FORBIDDEN = {'privateKey', 'token', 'password', 'customerData'}
AMBIGUOUS_OWNER = re.compile(r'^(both|joint|tbd|双方|共同负责|待定)$', re.I)
ALLOWED_STATUS = {'planned', 'blocked', 'delivered', 'accepted'}

def stop(message):
    raise SystemExit(message)

def text(value):
    return str(value).strip()

def validate_item(item, index, approver):
    if not isinstance(item, dict):
        stop(f'deliverable {index} is not an object')
    leaked = FORBIDDEN.intersection(item)
    if leaked:
        stop(f'deliverable {index} contains forbidden fields')
    missing = sorted(REQUIRED_ITEM - item.keys())
    if missing:
        stop(f'deliverable {index} lacks fields: {missing}')
    owner = text(item['owner'])
    if not owner or AMBIGUOUS_OWNER.fullmatch(owner):
        stop(f'deliverable {index} has an ambiguous owner')
    if item['status'] not in ALLOWED_STATUS:
        stop(f'deliverable {index} has invalid status')
    if not text(item['artifactRef']):
        stop(f'deliverable {index} has no artifact reference')
    if not isinstance(item['exclusions'], list):
        stop(f'deliverable {index} exclusions must be a list')
    evidence = text(item['acceptanceEvidence'])
    if item['status'] == 'accepted' and not evidence:
        stop(f'deliverable {index} is accepted without evidence')
    if item['status'] == 'accepted' and not approver:
        stop(f'deliverable {index} is accepted without approver')
    return item['id']

if len(sys.argv) != 2:
    stop('usage: validate_sow.py sow.json')
source = Path(sys.argv[1])
if not source.is_file():
    raise SystemExit('SOW file is missing')
sow = json.loads(source.read_text(encoding='utf-8'))
if not isinstance(sow, dict):
    raise SystemExit('SOW root must be an object')
missing_root = sorted(REQUIRED_ROOT - sow.keys())
if missing_root:
    raise SystemExit(f'SOW lacks root fields: {missing_root}')
if FORBIDDEN.intersection(sow):
    raise SystemExit('SOW contains forbidden root fields')
approver = text(sow['approver'])
if not approver or AMBIGUOUS_OWNER.fullmatch(approver):
    raise SystemExit('SOW must name one approval role')
for field in ('changeControl', 'exitConditions'):
    if not text(sow[field]):
        raise SystemExit(f'SOW has empty {field}')
items = sow['deliverables']
if not isinstance(items, list) or not items:
    raise SystemExit('SOW deliverables are missing')
ids = [validate_item(item, index, approver) for index, item in enumerate(items)]
if len(ids) != len(set(ids)):
    raise SystemExit('SOW contains duplicate deliverable ids')
print(json.dumps({'deliverables': len(ids), 'status': 'pass'}))