feat: add deployment foundation and cross-device handoff

2026-09-25 08:49:19 +08:00
parent 8ccb8b7c15
commit e965b0943d
77 changed files with 8018 additions and 0 deletions
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Local opt-in public deb download/hash test. No extraction, APT or installation.
+# Called by probe-docker-repository.sh after authenticated metadata verification.
+set -euo pipefail
+[[ $# == 3 && -f "$1" && -d "$2" ]]
+binary=$1
+metadata_dir=$2
+metadata_request=$3
+probe_dir=$(mktemp -d /tmp/server-deploy-artifacts.XXXXXX)
+chmod 700 "$probe_dir"
+artifact_dir="$probe_dir/debs"
+mkdir -m 700 "$artifact_dir"
+# Only authenticated lock paths, fixed origin, no caller-provided download URLs.
+python3 -I -c 'import json,re,sys; r=json.load(sys.stdin); assert r["repositoryAuthenticated"] is True; p=r["lock"]["packages"]; assert len(p)==5; [None if re.fullmatch(r"dists/resolute/pool/stable/amd64/[a-z0-9.+~_-]+\.deb",x["filename"]) and 0<x["size"]<=536870912 else sys.exit(1) for x in p]; [print(x["filename"],x["size"]) for x in p]' < "$metadata_dir/result.json" > "$probe_dir/downloads"
+while read -r filename size; do
+  curl --fail --silent --show-error --proto '=https' --max-time 90 --max-filesize "$size" \
+    "https://download.docker.com/linux/ubuntu/$filename" -o "$artifact_dir/${filename##*/}"
+done < "$probe_dir/downloads"
+request=$(printf '%s\n' "$metadata_request" | python3 -I -c 'import json,sys; r=json.load(sys.stdin); r["artifactDirectory"]=sys.argv[1]; print(json.dumps(r))' "$artifact_dir")
+printf '%s\n' "$request" | "$binary" verify-artifacts > "$probe_dir/result.json"
+python3 -I -c 'import json,sys; r=json.load(sys.stdin); assert r["repositoryAuthenticated"] is True; assert r["packageBytesVerified"] is True; assert r["executable"] is False; assert len(r["lock"]["packages"])==5' < "$probe_dir/result.json"
+cat "$probe_dir/result.json"
+# Same-size mutation: digest comparison, not an earlier size check, must reject.
+first=$(head -n 1 "$probe_dir/downloads")
+filename=${first% *}
+printf 'X' | dd of="$artifact_dir/${filename##*/}" bs=1 count=1 conv=notrunc status=none
+if printf '%s\n' "$request" | "$binary" verify-artifacts > "$probe_dir/rejected.json"; then
+  printf 'ERROR: same-size deb tamper accepted\n' >&2
+  exit 1
+fi
+[[ ! -s "$probe_dir/rejected.json" ]]
+printf 'Five real deb files verified; same-size tamper rejected. Local artifacts: %s\n' "$artifact_dir"