软件加固配置基线应该记录哪些字段

#!/usr/bin/env python3
import copy
import hashlib
import json
import re
import sys
from pathlib import Path

SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
FORBIDDEN_KEYS = {
    "password", "passwd", "token", "apiKey", "secret",
    "privateKey", "keystorePassword", "keyPassword", "recoveryCode",
}
ALLOWED_TOP_LEVEL = {
    "schemaVersion", "platform", "variant", "tool", "materials",
    "targets", "exclusions", "runtimePolicies", "signing", "approvals",
}
SORTED_LIST_FIELDS = {
    "abiFilters", "flavors", "requiredTests", "excludedModes",
    "runtimePolicies", "resolvedObjects",
}

def fail(message, code=2):
    print(message, file=sys.stderr)
    raise SystemExit(code)

def sha256_bytes(value):
    return hashlib.sha256(value).hexdigest()

def sha256_file(path):
    digest = hashlib.sha256()
    with path.open("rb") as handle:
        for block in iter(lambda: handle.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()

def load_config(path):
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
        fail("cannot read configuration: " + str(exc))
    if not isinstance(value, dict):
        fail("configuration must be a JSON object")
    return value

def require_text(record, field, context):
    value = record.get(field)
    if not isinstance(value, str) or not value.strip():
        fail(context + " is missing " + field)
    return value.strip()

def reject_secrets(value, path="$"):
    if isinstance(value, dict):
        for key, child in value.items():
            if key in FORBIDDEN_KEYS:
                fail("forbidden sensitive field: " + path + "." + key, 3)
            reject_secrets(child, path + "." + key)
    elif isinstance(value, list):
        for index, child in enumerate(value):
            reject_secrets(child, path + "[" + str(index) + "]")

def validate_sha(value, context):
    if not isinstance(value, str) or not SHA256_RE.fullmatch(value.lower()):
        fail(context + " must be a SHA-256 digest")
    return value.lower()

def validate_variant(variant):
    if not isinstance(variant, dict):
        fail("variant must be an object")
    for field in ("buildType", "applicationId", "versionCode", "versionName", "minSdk", "targetSdk"):
        require_text(variant, field, "variant")
    for field in ("flavors", "abiFilters"):
        if not isinstance(variant.get(field), list):
            fail("variant." + field + " must be an array")

def validate_tool(tool):
    if not isinstance(tool, dict):
        fail("tool must be an object")
    for field in ("name", "version", "ruleSchemaVersion"):
        require_text(tool, field, "tool")
    validate_sha(tool.get("binarySha256"), "tool.binarySha256")

def validate_materials(materials):
    if not isinstance(materials, list) or not materials:
        fail("materials must be a non-empty array")
    names = set()
    for record in materials:
        if not isinstance(record, dict):
            fail("every material must be an object")
        name = require_text(record, "logicalName", "material")
        if name in names:
            fail("duplicate material logicalName: " + name)
        names.add(name)
        validate_sha(record.get("sha256"), name + ".sha256")
        require_text(record, "sourceReference", name)
        require_text(record, "sensitivityClass", name)

def validate_targets(targets):
    if not isinstance(targets, list) or not targets:
        fail("targets must be a non-empty array")
    for index, record in enumerate(targets):
        context = "target[" + str(index) + "]"
        if not isinstance(record, dict):
            fail(context + " must be an object")
        for field in ("objectType", "selector", "mode", "owner", "rationale"):
            require_text(record, field, context)
        if not isinstance(record.get("requiredTests"), list) or not record["requiredTests"]:
            fail(context + " requiredTests must be a non-empty array")

def validate_exclusions(exclusions):
    if not isinstance(exclusions, list):
        fail("exclusions must be an array")
    for index, record in enumerate(exclusions):
        context = "exclusion[" + str(index) + "]"
        if not isinstance(record, dict):
            fail(context + " must be an object")
        for field in ("selector", "reason", "owner", "riskAcceptedBy", "linkedIssue", "reviewAt"):
            require_text(record, field, context)
        if not isinstance(record.get("excludedModes"), list) or not record["excludedModes"]:
            fail(context + " excludedModes must be a non-empty array")

def validate_approvals(approvals):
    if not isinstance(approvals, list) or not approvals:
        fail("approvals must be a non-empty array")
    for index, record in enumerate(approvals):
        context = "approval[" + str(index) + "]"
        if not isinstance(record, dict):
            fail(context + " must be an object")
        for field in ("role", "identity", "scope", "decision", "approvedAt", "evidenceReference"):
            require_text(record, field, context)

def normalize(value, parent_key=""):
    if isinstance(value, dict):
        return {key: normalize(value[key], key) for key in sorted(value)}
    if isinstance(value, list):
        normalized = [normalize(item) for item in value]
        if parent_key in SORTED_LIST_FIELDS and all(isinstance(item, str) for item in normalized):
            return sorted(set(normalized))
        if all(isinstance(item, dict) and "logicalName" in item for item in normalized):
            return sorted(normalized, key=lambda item: item["logicalName"])
        return normalized
    return value

def main():
    if len(sys.argv) != 3:
        print("Usage: baseline_hardening_config.py CONFIG_JSON CANDIDATE_FILE", file=sys.stderr)
        raise SystemExit(2)
    config_path = Path(sys.argv[1])
    candidate_path = Path(sys.argv[2])
    if not config_path.is_file() or not candidate_path.is_file():
        print("configuration and candidate files must exist", file=sys.stderr)
        raise SystemExit(2)
    config = load_config(config_path)
    unknown = sorted(set(config) - ALLOWED_TOP_LEVEL)
    if unknown:
        fail("unknown top-level fields: " + ", ".join(unknown))
    reject_secrets(config)
    require_text(config, "schemaVersion", "configuration")
    require_text(config, "platform", "configuration")
    validate_variant(config.get("variant"))
    validate_tool(config.get("tool"))
    validate_materials(config.get("materials"))
    validate_targets(config.get("targets"))
    validate_exclusions(config.get("exclusions"))
    validate_approvals(config.get("approvals"))
    if not isinstance(config.get("runtimePolicies"), list):
        fail("runtimePolicies must be an array")
    signing = config.get("signing")
    if not isinstance(signing, dict):
        fail("signing must be an object")
    validate_sha(signing.get("expectedCertificateSha256"), "signing.expectedCertificateSha256")
    require_text(signing, "responsibility", "signing")

    normalized = normalize(copy.deepcopy(config))
    canonical = json.dumps(normalized, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")
    config_sha = sha256_bytes(canonical)
    candidate_sha = sha256_file(candidate_path)
    input_material = next((item for item in normalized["materials"] if item["logicalName"] == "input-application"), None)
    if input_material is None:
        fail("materials must include input-application")
    statement = {
        "_type": "https://in-toto.io/Statement/v1",
        "subject": [{"name": candidate_path.name, "digest": {"sha256": candidate_sha}}],
        "predicateType": "https://example.invalid/hardening-configuration/v1",
        "predicate": {
            "configSha256": config_sha,
            "sourceConfigSha256": sha256_file(config_path),
            "inputArtifactSha256": input_material["sha256"],
            "schemaVersion": normalized["schemaVersion"],
            "platform": normalized["platform"],
            "variant": normalized["variant"],
            "tool": normalized["tool"],
            "boundary": "Configuration identity does not prove protection strength or runtime compatibility.",
        },
    }
    print(json.dumps(statement, ensure_ascii=False, indent=2, sort_keys=True))

if __name__ == "__main__":
    main()