生产签名密钥疑似泄露：加固项目怎样配合轮换与版本处置

import hashlib
import json
import sys
from pathlib import Path

REQUIRED = set([
  'caseId',
  'applicationId',
  'certificateFingerprint',
  'sourceVersion',
  'expectedPath',
  'observedPath',
  'result',
  'evidenceRef'
])
ALLOWED_RESULTS = set([
  'pass',
  'blocked',
  'mismatch'
])
FORBIDDEN = {'token', 'password', 'privateKey', 'secret', 'customerData'}

def stop(message):
    raise SystemExit(message)

def digest(path):
    hasher = hashlib.sha256()
    with path.open('rb') as stream:
        for chunk in iter(lambda: stream.read(1024 * 1024), b''):
            hasher.update(chunk)
    return hasher.hexdigest()

def text(record, field, index):
    value = str(record[field]).strip()
    if not value:
        stop(f'record {index} has empty {field}')
    return value

def validate(record, index):
    if not isinstance(record, dict):
        stop(f'record {index} is not an object')
    if FORBIDDEN.intersection(record):
        stop(f'record {index} contains forbidden fields')
    missing = sorted(REQUIRED - record.keys())
    if missing:
        raise SystemExit(f'record {index} lacks fields: {missing}')
    for field in REQUIRED:
        if field != 'sourceVersion':
            text(record, field, index)
    result = text(record, 'result', index)
    if result not in ALLOWED_RESULTS:
        stop(f'record {index} has an unsupported result')
    expected = text(record, 'expectedPath', index)
    observed = text(record, 'observedPath', index)
    evidence = text(record, 'evidenceRef', index)
    if expected != observed and result == 'pass':
        stop(f'record {index} passes despite a mismatch')
    if expected != observed and not evidence:
        stop(f'record {index} has a mismatch without evidence')
    return text(record, 'caseId', index)

if len(sys.argv) != 2:
    stop('usage: python validate_signing_response.py public-checks.json')
source = Path(sys.argv[1]).expanduser().resolve()
if not source.is_file():
    stop('public check file is missing')
raw = source.read_bytes()
data = json.loads(raw.decode('utf-8'))
records = data.get('responseCases') if isinstance(data, dict) else None
if not isinstance(records, list) or not records:
    raise SystemExit('responseCases must be a non-empty list')
identifiers = [validate(record, index) for index, record in enumerate(records)]
if len(identifiers) != len(set(identifiers)):
    raise SystemExit('record identifiers are duplicated')
summary = {
    'inputSha256': hashlib.sha256(raw).hexdigest(),
    'records': len(records),
    'results': {state: sum(1 for item in records if item['result'] == state) for state in sorted(ALLOWED_RESULTS)},
    'status': 'pass',
}
print(json.dumps(summary, ensure_ascii=False, sort_keys=True))