第三方预编译 SO 加固前怎样证明来源与版本

import hashlib
import json
import struct
import sys
from pathlib import Path

if len(sys.argv) != 4:
    raise SystemExit('usage: provenance_gate.py SO MANIFEST STATEMENT')
so_path = Path(sys.argv[1])
manifest_path = Path(sys.argv[2])
statement_path = Path(sys.argv[3])
for path in (so_path, manifest_path, statement_path):
    if not path.is_file():
        raise SystemExit(f'missing input: {path.name}')
so_bytes = so_path.read_bytes()
if len(so_bytes) < 20 or so_bytes[:4] != b'\x7fELF':
    raise SystemExit('input is not a complete ELF file')
if so_bytes[5] not in (1, 2):
    raise SystemExit('unsupported ELF byte order')
byte_order = '<' if so_bytes[5] == 1 else '>'
machine = struct.unpack(byte_order + 'H', so_bytes[18:20])[0]
abi_by_machine = {3: 'x86', 40: 'armeabi-v7a', 62: 'x86_64', 183: 'arm64-v8a'}
actual_abi = abi_by_machine.get(machine)
if actual_abi is None:
    raise SystemExit(f'unsupported ELF machine: {machine}')
actual_digest = hashlib.sha256(so_bytes).hexdigest()
manifest = json.loads(manifest_path.read_text(encoding='utf-8'))
for field in ('sha256', 'abi', 'supplier', 'version', 'source'):
    if not isinstance(manifest.get(field), str) or not manifest[field].strip():
        raise SystemExit(f'manifest field is missing: {field}')
if manifest['sha256'].lower() != actual_digest:
    raise SystemExit('manifest digest does not match the SO')
if manifest['abi'] != actual_abi:
    raise SystemExit('manifest ABI does not match the ELF header')
statement = json.loads(statement_path.read_text(encoding='utf-8'))
subjects = statement.get('subject')
if not isinstance(subjects, list) or not subjects:
    raise SystemExit('attestation subject is missing')
matched = any(item.get('digest', {}).get('sha256', '').lower() == actual_digest for item in subjects)
if not matched:
    raise SystemExit('attestation subject does not match the SO')
print(json.dumps({'sha256': actual_digest, 'abi': actual_abi, 'version': manifest['version']}))