"""Verify the exact authorized archive and prepare private snapshots; do not stage active code.""" from pathlib import Path from datetime import datetime, timezone import json, hashlib, zipfile, shutil from cryptography import x509 from cryptography.hazmat.primitives import hashes, serialization ROOT=Path(__file__).resolve().parent.parent D=ROOT/'storage/app/private/investmoz-v2/portal-audit' OUT=ROOT/'outputs/investmoz-portal-stability-20261011' read=lambda p:json.loads(Path(p).read_text(encoding='utf-8-sig')) sha=lambda p:hashlib.sha256(Path(p).read_bytes()).hexdigest() manifest=read(OUT/'manifesto-candidata.json'); envelope=read(OUT/'manifesto-pacote.json') REV='485ee04c40b2754ab668f48fd84d8559fb19a8b98f4b9af50fc0517bb488ca76' ARCHIVE='033368b9532c94e303de07330abe6ab4afa63d9d6f2879044bfd3fe680364704' assert manifest['delivery_revision']==envelope['delivery_revision']==REV assert sha(OUT/envelope['archive'])==envelope['archive_sha256']==ARCHIVE assert hashlib.sha256(json.dumps(manifest['revision_input'],sort_keys=True,separators=(',',':')).encode()).hexdigest()==REV directory=D/('stability-active-'+datetime.now(timezone.utc).strftime('%Y%m%d_%H%M%S'));directory.mkdir(exist_ok=False) package=directory/'verified-package';package.mkdir() with zipfile.ZipFile(OUT/envelope['archive']) as z: assert len(z.namelist())==envelope['entries'] and set(z.namelist())==set(envelope['verified_members_sha256']) for name,digest in envelope['verified_members_sha256'].items(): assert ':' not in name and not name.startswith(('/', '\\')) and not any(p in ['.','..'] for p in name.split('/')) b=z.read(name);assert hashlib.sha256(b).hexdigest()==digest target=package/name;assert target.resolve().is_relative_to(package.resolve());target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(b) changed=manifest['revision_input']['application_files'] for name,record in changed.items(): target=ROOT/name assert (sha(target) if target.exists() else None)==record['active_before'], 'Active source differs: '+name assert sha(package/'application'/name)==record['after'] for name,digest in manifest['production_inputs'].items(): if name not in changed:assert (ROOT/name).is_file() and sha(ROOT/name)==digest, 'Unchanged application input differs: '+name baseline=read(D/'portal-stability-latest.json') for filename in ['country02-interface.json','country02-persistencia.json','consumidores-persistencia.json','runtime-qa.json','backup-pos-utilizacao-qa.json']: assert read(package/filename)['result']=='passed' assert not (ROOT/'bootstrap/cache/config.php').exists(),'Unexpected config cache' fresh=read(D/'country-candidate-backup-latest.json');backup=read(fresh['path']) assert backup['restore_verified'] and backup['files_verified'] and backup['sequences_verified'] and not backup['source_installations']['country_flag'] assert backup['source_installations']['migrations']==[] and backup['source_installations']['country_columns']==[] assert backup['installer_eligibility_counts']['verified_managers_with_mfa']>0,'No existing verified manager with normal MFA' assert sha(backup['dump_path'])==backup['dump_sha256'] and sha(backup['files_path'])==backup['files_sha256'] assert 0<=(datetime.now(timezone.utc)-datetime.fromisoformat(backup['verified_at'])).total_seconds()<86400 old=read(read(D/'country-https-backup-latest.json')['path']) volatile={'"public"."sessions"','"public"."cache"','"public"."cache_locks"'} assert set(old['tables'])==set(backup['tables']) and old['sequences']==backup['sequences'] assert all(state==old['tables'][name] for name,state in backup['tables'].items() if name not in volatile),'Business baseline differs from demonstrated QA' config=read(ROOT/'outputs/investmoz-country02-https-20261011/configuracao-ativa-leitura.json') for name in ['active_vhost','apache_config','ssl_include']: assert sha(config[name]['path'])==config[name]['sha256'],'Apache baseline differs' apache=Path('C:/laragon/bin/apache/httpd-2.4.54-win64-VS16/bin/httpd.exe') dll=apache.parent/'nghttp2.dll' assert sha(dll)=='27dbfd55cbff5dc0f580b4e109f18e651c804322382c04dd9588c733517a34f6' assert sha(package/'runtime/nghttp2.dll')=='4bee6c3aa3270c49395ff528db1ebd1e3d78c211503a7b9ea6c23aa9ad2dec85' tls=Path('C:/Users/macbook/.config/investmoz/tls') leaf,ca=x509.load_pem_x509_certificates((tls/'portal-investidor.test-fullchain.pem').read_bytes()) key=serialization.load_pem_private_key((tls/'portal-investidor.test-key.pem').read_bytes(),None) assert ca.fingerprint(hashes.SHA1()).hex().upper()=='7D30D7FB226481B6243051309818CF426AF6B6B7' assert leaf.fingerprint(hashes.SHA256()).hex()=='df368329204106b6a182c79e7e5c98a8e73890479cb7bca7c3d0928076a60ed5' assert leaf.not_valid_before_utc<=datetime.now(timezone.utc)