mirror of
https://github.com/block/buzz.git
synced 2026-10-28 13:01:10 +00:00
33 lines
1.4 KiB
Python
33 lines
1.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Trust only Buzz's reviewed, pinned Swift build plugin on a build worker."""
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
|
|
|
|
def trust_plugin(destination, root):
|
|
"""Preserve other trust entries and reject an unreviewed package revision."""
|
|
entry = {
|
|
"fingerprint": "e70a10e036a55fffea31568f0af92d69b6d449cd",
|
|
"packageIdentity": "swift-secp256k1",
|
|
"targetName": "SharedSourcesPlugin",
|
|
}
|
|
lock = json.loads((root / "mobile/ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved").read_text())
|
|
pin = next(pin for pin in lock["pins"] if pin["identity"] == entry["packageIdentity"])
|
|
if pin["state"]["revision"] != entry["fingerprint"]:
|
|
raise ValueError("Review the changed Swift plugin before updating its trusted fingerprint")
|
|
entries = json.loads(destination.read_text()) if destination.exists() else []
|
|
if not isinstance(entries, list):
|
|
raise ValueError("Expected a Swift plugin trust list")
|
|
if entry not in entries:
|
|
entries.append(entry)
|
|
destination.parent.mkdir(parents=True, exist_ok=True)
|
|
destination.write_text(json.dumps(entries, indent=2) + "\n")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--trust-file", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
trust_plugin(args.trust_file, Path(__file__).resolve().parent.parent)
|