软件加固、生产签名与正式发布为什么必须职责分离

import json
import sys
from datetime import datetime, timezone
from pathlib import Path

CRITICAL = {
    'replace-hardened-artifact',
    'production-sign',
    'production-release',
}

if len(sys.argv) != 2:
    raise SystemExit('usage: validate_sod.py permissions.json')
path = Path(sys.argv[1])
if not path.is_file():
    raise SystemExit('permissions file is missing')
data = json.loads(path.read_text(encoding='utf-8'))
subjects = data.get('subjects')
if not isinstance(subjects, list) or not subjects:
    raise SystemExit('subjects array is missing')
seen = set()
coverage = {permission: set() for permission in CRITICAL}
for index, subject in enumerate(subjects):
    name = str(subject.get('name', '')).strip()
    kind = str(subject.get('kind', '')).strip()
    permissions = subject.get('permissions')
    if not name or name in seen:
        raise SystemExit(f'invalid or duplicate subject at index {index}')
    if kind not in {'person', 'service', 'vendor'}:
        raise SystemExit(f'{name}: unsupported subject kind')
    if not isinstance(permissions, list) or not permissions:
        raise SystemExit(f'{name}: permissions must be a non-empty list')
    permission_set = {str(item).strip() for item in permissions}
    if '' in permission_set:
        raise SystemExit(f'{name}: blank permission')
    seen.add(name)
    for permission in CRITICAL:
        if permission in permission_set:
            coverage[permission].add(name)
    if CRITICAL <= permission_set:
        raise SystemExit(f'{name}: can replace, sign and release one candidate')
    if kind == 'vendor' and 'production-sign' in permission_set:
        raise SystemExit(f'{name}: vendor has production signing permission')
for permission, owners in coverage.items():
    if not owners:
        raise SystemExit(f'missing owner for {permission}')
break_glass = data.get('break_glass')
if break_glass is not None:
    required = {'approved_by', 'ticket', 'expires_at'}
    if not isinstance(break_glass, dict) or not required <= break_glass.keys():
        raise SystemExit('break_glass record is incomplete')
    expires_at = datetime.fromisoformat(break_glass['expires_at'].replace('Z', '+00:00'))
    if expires_at <= datetime.now(timezone.utc):
        raise SystemExit('break_glass authorization has expired')
print(json.dumps({'subjects': len(subjects), 'coverage': sorted(coverage), 'status': 'pass'}))