第三方 SDK 升级后为什么需要重新评估加固配置

#!/usr/bin/env python3
import hashlib
import json
import re
import sys
from pathlib import Path

SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
LIST_FIELDS = (
    "initializers", "permissions", "nativeLibraries",
    "reflectionNamespaces", "privacyDeclarations", "dependencyPaths",
)
FIELD_GATES = {
    "initializers": {"startup", "lifecycle"},
    "permissions": {"permission-data-review", "denial-path"},
    "nativeLibraries": {"native-abi-specialist", "device-matrix"},
    "reflectionNamespaces": {"reflection-serialization", "release-runtime"},
    "privacyDeclarations": {"privacy-review", "data-behavior"},
    "dependencyPaths": {"dependency-resolution", "ownership-review"},
    "consumerRulesSha256": {"shrinker-rules", "release-runtime"},
}

def fail(message, code=2):
    print(message, file=sys.stderr)
    raise SystemExit(code)

def sha256_file(path):
    digest = hashlib.sha256()
    with path.open("rb") as handle:
        for block in iter(lambda: handle.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()

def load_json(path, label):
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
        fail("cannot read " + label + ": " + str(exc))
    if not isinstance(value, dict):
        fail(label + " must be a JSON object")
    return value

def require_text(record, field, context):
    value = record.get(field)
    if not isinstance(value, str) or not value.strip():
        fail(context + " is missing " + field)
    return value.strip()

def normalize_list(record, field, context):
    value = record.get(field)
    if not isinstance(value, list):
        fail(context + " is missing array field " + field)
    if any(not isinstance(item, str) or not item.strip() for item in value):
        fail(context + " has invalid " + field)
    return sorted(set(item.strip() for item in value))

def normalize_component(record):
    if not isinstance(record, dict):
        fail("every dependency must be an object")
    key = require_text(record, "key", "dependency")
    version = require_text(record, "version", key)
    artifact_sha = require_text(record, "artifactSha256", key).lower()
    rules_sha = require_text(record, "consumerRulesSha256", key).lower()
    if not SHA256_RE.fullmatch(artifact_sha) or not SHA256_RE.fullmatch(rules_sha):
        fail(key + " has an invalid SHA-256 field")
    direct = record.get("direct")
    if not isinstance(direct, bool):
        fail(key + " direct must be boolean")
    normalized = {
        "key": key,
        "version": version,
        "artifactSha256": artifact_sha,
        "consumerRulesSha256": rules_sha,
        "direct": direct,
    }
    for field in LIST_FIELDS:
        normalized[field] = normalize_list(record, field, key)
    return normalized

def index_snapshot(snapshot, label):
    platform = require_text(snapshot, "platform", label)
    variant = require_text(snapshot, "variant", label)
    candidate_sha = require_text(snapshot, "candidateSha256", label).lower()
    if not SHA256_RE.fullmatch(candidate_sha):
        fail(label + " candidateSha256 is invalid")
    dependencies = snapshot.get("dependencies")
    if not isinstance(dependencies, list):
        fail(label + " dependencies must be an array")
    index = {}
    for item in dependencies:
        normalized = normalize_component(item)
        key = normalized["key"]
        if key in index:
            fail(label + " has duplicate dependency key: " + key)
        index[key] = normalized
    return {"platform": platform, "variant": variant, "candidateSha256": candidate_sha, "dependencies": index}

def compare_component(old, new):
    changes = {}
    gates = {"release-build", "core-regression"}
    for field in ("version", "artifactSha256", "direct", "consumerRulesSha256", *LIST_FIELDS):
        if old[field] != new[field]:
            changes[field] = {"old": old[field], "new": new[field]}
            gates.update(FIELD_GATES.get(field, {"dependency-resolution"}))
    if old["version"] == new["version"] and old["artifactSha256"] != new["artifactSha256"]:
        gates.add("source-integrity-review")
    return changes, sorted(gates)

def compare(old, new):
    results = []
    old_items = old["dependencies"]
    new_items = new["dependencies"]
    for key in sorted(old_items.keys() - new_items.keys()):
        results.append({"key": key, "kind": "removed", "affectedGates": ["config-cleanup", "dependency-resolution", "release-build", "core-regression"]})
    for key in sorted(new_items.keys() - old_items.keys()):
        gates = {"dependency-resolution", "release-build", "core-regression", "inventory-review"}
        for field in LIST_FIELDS:
            if new_items[key][field]:
                gates.update(FIELD_GATES[field])
        results.append({"key": key, "kind": "added", "affectedGates": sorted(gates)})
    for key in sorted(old_items.keys() & new_items.keys()):
        changes, gates = compare_component(old_items[key], new_items[key])
        if changes:
            results.append({"key": key, "kind": "changed", "changes": changes, "affectedGates": gates})
    return results

def main():
    if len(sys.argv) != 3:
        print("Usage: compare_sdk_snapshots.py OLD_SNAPSHOT_JSON NEW_SNAPSHOT_JSON", file=sys.stderr)
        raise SystemExit(2)
    old_path = Path(sys.argv[1])
    new_path = Path(sys.argv[2])
    if not old_path.is_file() or not new_path.is_file():
        print("both snapshot files must exist", file=sys.stderr)
        raise SystemExit(2)
    old = index_snapshot(load_json(old_path, "old snapshot"), "old snapshot")
    new = index_snapshot(load_json(new_path, "new snapshot"), "new snapshot")
    if old["platform"] != new["platform"] or old["variant"] != new["variant"]:
        fail("snapshots must use the same platform and release variant", 3)
    changes = compare(old, new)
    result = {
        "status": "changes-detected" if changes else "no-normalized-change",
        "platform": old["platform"],
        "variant": old["variant"],
        "oldSnapshotSha256": sha256_file(old_path),
        "newSnapshotSha256": sha256_file(new_path),
        "oldCandidateSha256": old["candidateSha256"],
        "newCandidateSha256": new["candidateSha256"],
        "changes": changes,
        "boundary": "Snapshot diff defines review scope; it does not prove SDK safety or candidate compatibility.",
    }
    print(json.dumps(result, ensure_ascii=False, indent=2, sort_keys=True))
    if changes:
        raise SystemExit(20)

if __name__ == "__main__":
    main()