File size: 2,027 Bytes
b67a1e9 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 | #!/usr/bin/env python3
import json
import re
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
errors = []
SECRET_RE = re.compile(r"(BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY|AWS_SECRET_ACCESS_KEY|ghp_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9]{20,}|xox[baprs]-)")
for p in [ROOT/'inventory'/'raw_scan.jsonl', ROOT/'inventory'/'projects.jsonl']:
if not p.exists() or p.stat().st_size == 0:
errors.append(f"missing_or_empty: {p.relative_to(ROOT)}")
projects = []
for jsonl in [ROOT/'inventory'/'raw_scan.jsonl', ROOT/'inventory'/'projects.jsonl']:
if not jsonl.exists():
continue
for i, line in enumerate(jsonl.read_text(encoding='utf-8', errors='ignore').splitlines(), 1):
if not line.strip():
continue
if SECRET_RE.search(line):
errors.append(f"secret_like_content: {jsonl.relative_to(ROOT)}:{i}")
try:
obj = json.loads(line)
except Exception as e:
errors.append(f"invalid_jsonl: {jsonl.relative_to(ROOT)}:{i}: {e}")
continue
if jsonl.name == 'projects.jsonl':
projects.append(obj)
for k in ['project_id','name','path','last_modified','is_git_repo','technologies','risk_level','evidence_file','triage_status','score']:
if k not in obj:
errors.append(f"projects.jsonl:{i} missing {k}")
ev = obj.get('evidence_file')
if ev:
ep = ROOT / ev
try:
ep.resolve().relative_to((ROOT/'inventory'/'evidence').resolve())
except Exception:
errors.append(f"evidence outside evidence dir: {ev}")
if not ep.exists():
errors.append(f"missing evidence: {ev}")
if not projects:
errors.append('no_projects_found')
if errors:
print('verify_inventory: failed')
for e in errors:
print(f'- {e}')
raise SystemExit(1)
print(f'verify_inventory: passed ({len(projects)} projects)')
|