Initial Alpine security mirror

scripts/validate.py

@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+"""Validate the complete Alpine mirror against the tracked manifest."""
+import hashlib,json,sys
+from pathlib import Path
+
+def main():
+ root=Path(__file__).resolve().parents[1]
+ manifest=json.loads((root/'state/manifest.json').read_text())
+ files=manifest.get('files',{})
+ if not files: raise ValueError('No manifest entries')
+ for rel,entry in files.items():
+  p=(root/'data/secdb'/rel).resolve()
+  if not p.is_relative_to((root/'data/secdb').resolve()): raise ValueError('Unsafe path')
+  b=p.read_bytes()
+  if hashlib.sha256(b).hexdigest()!=entry['sha256']: raise ValueError('Hash mismatch: '+rel)
+  obj=json.loads(b)
+  if not isinstance(obj,dict) or not isinstance(obj.get('packages'),list): raise ValueError('Invalid secdb data: '+rel)
+  if len(obj['packages'])!=entry['packages']: raise ValueError('Package count mismatch: '+rel)
+ print(f'Validated {len(files)} Alpine security database files')
+if __name__=='__main__':
+ try: main()
+ except Exception as e: print(f'Validation failed: {e}',file=sys.stderr);sys.exit(1)