Spaces:
Running
Running
Deploy Aureon OS (deploy/selfhost stack: nginx edge + fusion API x2 + console + HNC organ + redis + postgres; paper mode) (part 21)
ecbe9c0 verified | """Isolated, package-free trust bootstrap for website runtime optimisation. | |
| The caller must authenticate this launcher before invoking it and supply the | |
| reviewed planner SHA-256. The launcher then reads that exact planner through a | |
| bound handle and executes the authenticated bytes as ``__main__`` without | |
| importing ``aureon`` or either package initializer. | |
| """ | |
| from __future__ import annotations | |
| import argparse | |
| import hashlib | |
| import os | |
| import re | |
| import stat | |
| import sys | |
| from pathlib import Path | |
| PLANNER_PATH = Path("aureon/operator/website_runtime_optimisation.py") | |
| MAX_PLANNER_BYTES = 2 * 1024 * 1024 | |
| _SHA256 = re.compile(r"[A-F0-9]{64}\Z") | |
| class TrustedLauncherError(RuntimeError): | |
| """The isolated launcher or reviewed planner binding is unsafe.""" | |
| def _is_link_or_reparse(path: Path) -> bool: | |
| details = path.lstat() | |
| attributes = int(getattr(details, "st_file_attributes", 0) or 0) | |
| reparse = int(getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400) or 0x400) | |
| return stat.S_ISLNK(details.st_mode) or bool(attributes & reparse) | |
| def _ordinary_file(path: Path, *, label: str) -> Path: | |
| lexical = Path(os.path.abspath(path)) | |
| for component in (lexical, *lexical.parents): | |
| if (component.exists() or component.is_symlink()) and _is_link_or_reparse(component): | |
| raise TrustedLauncherError(f"{label} may not cross a link or reparse point.") | |
| if not lexical.is_file() or int(lexical.stat().st_nlink) != 1: | |
| raise TrustedLauncherError(f"{label} must be an ordinary single-link file.") | |
| return lexical | |
| def _same_identity(left: os.stat_result, right: os.stat_result) -> bool: | |
| return ( | |
| stat.S_IFMT(left.st_mode) == stat.S_IFMT(right.st_mode) | |
| and int(left.st_dev) == int(right.st_dev) | |
| and int(left.st_ino) == int(right.st_ino) | |
| ) | |
| def _read_exact_source(path: Path, expected_sha256: str, *, label: str) -> bytes: | |
| source = _ordinary_file(path, label=label) | |
| before = source.lstat() | |
| if int(before.st_size) > MAX_PLANNER_BYTES: | |
| raise TrustedLauncherError(f"{label} exceeds the launcher byte bound.") | |
| with source.open("rb") as stream: | |
| opened = os.fstat(stream.fileno()) | |
| if not _same_identity(before, opened): | |
| raise TrustedLauncherError(f"{label} changed before its handle opened.") | |
| payload = stream.read(MAX_PLANNER_BYTES + 1) | |
| after = source.lstat() | |
| observed = hashlib.sha256(payload).hexdigest().upper() | |
| if ( | |
| len(payload) > MAX_PLANNER_BYTES | |
| or int(after.st_size) != len(payload) | |
| or not _same_identity(opened, after) | |
| or observed != expected_sha256 | |
| ): | |
| raise TrustedLauncherError(f"{label} bytes do not match the supplied source pin.") | |
| return payload | |
| def build_parser() -> argparse.ArgumentParser: | |
| parser = argparse.ArgumentParser(prog="run-website-runtime-optimisation") | |
| parser.add_argument("--expected-launcher-sha256", required=True) | |
| parser.add_argument("--expected-planner-sha256", required=True) | |
| parser.add_argument("planner_args", nargs=argparse.REMAINDER) | |
| return parser | |
| def main(argv: list[str] | None = None) -> int: | |
| if not (sys.flags.isolated and sys.flags.no_site and sys.dont_write_bytecode): | |
| raise TrustedLauncherError("Launcher requires python -I -S -B.") | |
| args = build_parser().parse_args(argv) | |
| expected_launcher = args.expected_launcher_sha256 | |
| expected_planner = args.expected_planner_sha256 | |
| if _SHA256.fullmatch(expected_launcher) is None or _SHA256.fullmatch(expected_planner) is None: | |
| raise TrustedLauncherError("Expected SHA-256 values must be 64 uppercase hexadecimal digits.") | |
| launcher = _ordinary_file(Path(__file__), label="Trusted runtime-optimisation launcher") | |
| _read_exact_source( | |
| launcher, | |
| expected_launcher, | |
| label="Trusted runtime-optimisation launcher", | |
| ) | |
| root = launcher.parent.parent | |
| planner = root / PLANNER_PATH | |
| payload = _read_exact_source( | |
| planner, | |
| expected_planner, | |
| label="Reviewed runtime-optimisation planner", | |
| ) | |
| forwarded = list(args.planner_args) | |
| if forwarded[:1] == ["--"]: | |
| forwarded = forwarded[1:] | |
| sys.argv = [str(planner), *forwarded] | |
| scope = { | |
| "__builtins__": __builtins__, | |
| "__cached__": None, | |
| "__file__": str(planner), | |
| "__name__": "__main__", | |
| "__package__": None, | |
| "__aureon_runtime_optimisation_launcher_attestation__": { | |
| "launcher_path": str(launcher), | |
| "launcher_sha256": expected_launcher, | |
| "planner_path": str(planner), | |
| "planner_sha256": expected_planner, | |
| "isolated": True, | |
| "no_site": True, | |
| "dont_write_bytecode": True, | |
| }, | |
| } | |
| exec(compile(payload, str(planner), "exec", dont_inherit=True), scope) # noqa: S102 | |
| return 0 | |
| if __name__ == "__main__": | |
| try: | |
| raise SystemExit(main()) | |
| except TrustedLauncherError as exc: | |
| print(f"blocked: {exc}", file=sys.stderr) | |
| raise SystemExit(2) from exc | |