Spaces:
Running
Running
File size: 5,081 Bytes
ecbe9c0 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 | """Isolated, package-free trust bootstrap for website runtime optimisation.
The caller must authenticate this launcher before invoking it and supply the
reviewed planner SHA-256. The launcher then reads that exact planner through a
bound handle and executes the authenticated bytes as ``__main__`` without
importing ``aureon`` or either package initializer.
"""
from __future__ import annotations
import argparse
import hashlib
import os
import re
import stat
import sys
from pathlib import Path
PLANNER_PATH = Path("aureon/operator/website_runtime_optimisation.py")
MAX_PLANNER_BYTES = 2 * 1024 * 1024
_SHA256 = re.compile(r"[A-F0-9]{64}\Z")
class TrustedLauncherError(RuntimeError):
"""The isolated launcher or reviewed planner binding is unsafe."""
def _is_link_or_reparse(path: Path) -> bool:
details = path.lstat()
attributes = int(getattr(details, "st_file_attributes", 0) or 0)
reparse = int(getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400) or 0x400)
return stat.S_ISLNK(details.st_mode) or bool(attributes & reparse)
def _ordinary_file(path: Path, *, label: str) -> Path:
lexical = Path(os.path.abspath(path))
for component in (lexical, *lexical.parents):
if (component.exists() or component.is_symlink()) and _is_link_or_reparse(component):
raise TrustedLauncherError(f"{label} may not cross a link or reparse point.")
if not lexical.is_file() or int(lexical.stat().st_nlink) != 1:
raise TrustedLauncherError(f"{label} must be an ordinary single-link file.")
return lexical
def _same_identity(left: os.stat_result, right: os.stat_result) -> bool:
return (
stat.S_IFMT(left.st_mode) == stat.S_IFMT(right.st_mode)
and int(left.st_dev) == int(right.st_dev)
and int(left.st_ino) == int(right.st_ino)
)
def _read_exact_source(path: Path, expected_sha256: str, *, label: str) -> bytes:
source = _ordinary_file(path, label=label)
before = source.lstat()
if int(before.st_size) > MAX_PLANNER_BYTES:
raise TrustedLauncherError(f"{label} exceeds the launcher byte bound.")
with source.open("rb") as stream:
opened = os.fstat(stream.fileno())
if not _same_identity(before, opened):
raise TrustedLauncherError(f"{label} changed before its handle opened.")
payload = stream.read(MAX_PLANNER_BYTES + 1)
after = source.lstat()
observed = hashlib.sha256(payload).hexdigest().upper()
if (
len(payload) > MAX_PLANNER_BYTES
or int(after.st_size) != len(payload)
or not _same_identity(opened, after)
or observed != expected_sha256
):
raise TrustedLauncherError(f"{label} bytes do not match the supplied source pin.")
return payload
def build_parser() -> argparse.ArgumentParser:
parser = argparse.ArgumentParser(prog="run-website-runtime-optimisation")
parser.add_argument("--expected-launcher-sha256", required=True)
parser.add_argument("--expected-planner-sha256", required=True)
parser.add_argument("planner_args", nargs=argparse.REMAINDER)
return parser
def main(argv: list[str] | None = None) -> int:
if not (sys.flags.isolated and sys.flags.no_site and sys.dont_write_bytecode):
raise TrustedLauncherError("Launcher requires python -I -S -B.")
args = build_parser().parse_args(argv)
expected_launcher = args.expected_launcher_sha256
expected_planner = args.expected_planner_sha256
if _SHA256.fullmatch(expected_launcher) is None or _SHA256.fullmatch(expected_planner) is None:
raise TrustedLauncherError("Expected SHA-256 values must be 64 uppercase hexadecimal digits.")
launcher = _ordinary_file(Path(__file__), label="Trusted runtime-optimisation launcher")
_read_exact_source(
launcher,
expected_launcher,
label="Trusted runtime-optimisation launcher",
)
root = launcher.parent.parent
planner = root / PLANNER_PATH
payload = _read_exact_source(
planner,
expected_planner,
label="Reviewed runtime-optimisation planner",
)
forwarded = list(args.planner_args)
if forwarded[:1] == ["--"]:
forwarded = forwarded[1:]
sys.argv = [str(planner), *forwarded]
scope = {
"__builtins__": __builtins__,
"__cached__": None,
"__file__": str(planner),
"__name__": "__main__",
"__package__": None,
"__aureon_runtime_optimisation_launcher_attestation__": {
"launcher_path": str(launcher),
"launcher_sha256": expected_launcher,
"planner_path": str(planner),
"planner_sha256": expected_planner,
"isolated": True,
"no_site": True,
"dont_write_bytecode": True,
},
}
exec(compile(payload, str(planner), "exec", dont_inherit=True), scope) # noqa: S102
return 0
if __name__ == "__main__":
try:
raise SystemExit(main())
except TrustedLauncherError as exc:
print(f"blocked: {exc}", file=sys.stderr)
raise SystemExit(2) from exc
|