444 lines
25 KiB
Python
444 lines
25 KiB
Python
#!/usr/bin/env python3
|
||
"""准备嵌入式图片协商候选版本；本工具不停止进程、不替换在用程序、不修改在用配置。"""
|
||
import argparse
|
||
import configparser
|
||
import hashlib
|
||
import io
|
||
import ipaddress
|
||
import json
|
||
import os
|
||
from pathlib import Path
|
||
import platform
|
||
import re
|
||
import shutil
|
||
import subprocess
|
||
import tarfile
|
||
import time
|
||
import uuid
|
||
|
||
|
||
# 本次仅交付图片地址协商代码；其他业务源码必须以当前开发板为基线。
|
||
# 不整份上传历史工程，避免覆盖最新日志保留、串口或RTP收流修改。
|
||
PATCH_FILES = (
|
||
"util/PlatformWireCodec.h", "util/PlatformWireCodec.cpp",
|
||
"util/PlatformImageRouteClient.h", "util/PlatformImageRouteClient.cpp",
|
||
"util/PlatformImageSender.h", "util/PlatformImageSender.cpp",
|
||
)
|
||
# 测试只运行临时目录与loopback，不使用实际设备密钥和采集端口。
|
||
TEST_FILES = (
|
||
"tests/image_route/native_image_route_check.pro",
|
||
"tests/image_route/native_image_route_check.cpp",
|
||
"tests/logging/native_logging_check.pro",
|
||
"tests/logging/native_logging_check.cpp",
|
||
)
|
||
ALLOWED = set(PATCH_FILES + TEST_FILES)
|
||
# 这些文件只记录哈希，以验证部署保留现有功能；本工具不会覆盖它们。
|
||
PRESERVED = (
|
||
"main.cpp", "util/log.cpp", "util/log.h", "util/CollectorLogRetention.cpp",
|
||
"util/CollectorLogRetention.h", "start.sh",
|
||
"Go2Controller/network/rtpreceiver.cpp", "Fly2Controller/network/RtpReceiver.cpp",
|
||
"util/ModuleVideoReceiver.cpp", "CJ2Controller/serialworker.cpp", "mainwindow.cpp",
|
||
)
|
||
|
||
|
||
def digest(path):
|
||
# 分块计算，避免相机SDK等大文件一次读入内存。
|
||
value = hashlib.sha256()
|
||
with path.open("rb") as stream:
|
||
for block in iter(lambda: stream.read(1024 * 1024), b""):
|
||
value.update(block)
|
||
return value.hexdigest()
|
||
|
||
|
||
def write_json(path, value):
|
||
# 部署记录留在私有stage；不输出配置全文、密钥文件或进程环境。
|
||
path.write_text(json.dumps(value, ensure_ascii=False, indent=2), encoding="utf-8")
|
||
|
||
|
||
def package(args):
|
||
# 使用当前工作空间源码，禁止调用旧prepare-board-deployment脚本重建全量包。
|
||
# 包只携带本次代码与测试，不携带平台IP、上传配置、密钥或旧可执行文件。
|
||
# 压缩包不含旧可执行文件，必须经实际ARM工具链重新构建。
|
||
# 不读取本机现网INI，候选IP必须在板端stage时显式指定。
|
||
source = args.source.resolve(strict=True)
|
||
# 同名产物不覆盖，方便将每次候选与原始校验记录一一对应。
|
||
if args.package.exists():
|
||
raise RuntimeError("Package already exists; choose a new output filename")
|
||
args.package.parent.mkdir(parents=True, exist_ok=True)
|
||
manifest = {"protocol": "COLLECTOR_IMAGE_ROUTE", "format": 1, "files": []}
|
||
# 精确白名单不包含任何ini/密钥/运行目录，也不递归打包未知文件。
|
||
with tarfile.open(str(args.package), "w:gz") as archive:
|
||
for relative in PATCH_FILES + TEST_FILES:
|
||
path = source / relative
|
||
if path.is_symlink() or not path.resolve(strict=True).is_relative_to(source):
|
||
raise RuntimeError("Unexpected source path: " + relative)
|
||
data = path.read_bytes()
|
||
item = tarfile.TarInfo(relative)
|
||
item.size = len(data)
|
||
item.mode = 0o644
|
||
archive.addfile(item, io.BytesIO(data))
|
||
manifest["files"].append({"path": relative, "sha256": hashlib.sha256(data).hexdigest()})
|
||
data = json.dumps(manifest, ensure_ascii=False, indent=2).encode("utf-8")
|
||
item = tarfile.TarInfo("image-route-manifest.json")
|
||
item.size = len(data)
|
||
item.mode = 0o644
|
||
archive.addfile(item, io.BytesIO(data))
|
||
print(json.dumps({"package": str(args.package.resolve()), "files": len(ALLOWED),
|
||
"sha256": digest(args.package)}, ensure_ascii=False))
|
||
|
||
|
||
def live_root(args):
|
||
# 路径必须是已存在工程，禁止根目录及符号链接冒充部署目录。
|
||
if args.root.is_symlink():
|
||
raise RuntimeError("Collector root cannot be a symbolic link")
|
||
# 所有后续路径由规范化根目录拼接，不接收任意远端目标路径。
|
||
root = args.root.resolve(strict=True)
|
||
if root == Path(root.anchor) or not (root / "px_Collect.pro").is_file():
|
||
raise RuntimeError("Collector project root is invalid")
|
||
return root
|
||
|
||
|
||
def process_ids(root):
|
||
target = str(root / "bin/px_JKGL")
|
||
# 没有/proc时只用于本地安全测试，不声称发现了实际板端进程。
|
||
matches = []
|
||
# 仅核对可执行文件真实路径，不用进程名字匹配其他同名程序。
|
||
for entry in Path("/proc").iterdir() if Path("/proc").is_dir() else []:
|
||
if not entry.name.isdigit():
|
||
continue
|
||
try:
|
||
if os.readlink(str(entry / "exe")).replace(" (deleted)", "") == target:
|
||
matches.append(int(entry.name))
|
||
except (FileNotFoundError, PermissionError):
|
||
pass
|
||
return sorted(matches)
|
||
|
||
|
||
def inspect(args):
|
||
# 不主动建立SSH，操作者负责将工具上传到已确认的目标板再运行。
|
||
# inspect不改网络、时钟、配置、库或进程，输出可供root比对的哈希。
|
||
# 输出源码哈希供当前板与本机差异核对，不能把历史记录当成现网事实。
|
||
root = live_root(args)
|
||
# 地址和目标路径来自root确认，inspect只给非敏感状态与源码哈希。
|
||
print(json.dumps({"root": str(root), "architecture": platform.machine(),
|
||
"collectorPids": process_ids(root), "binaryPresent": (root / "bin/px_JKGL").is_file(),
|
||
"qmake": shutil.which("qmake"), "make": shutil.which("make"),
|
||
"preservedSources": {name: digest(root / name) for name in PRESERVED if (root / name).is_file()},
|
||
"sourceHashes": {name: digest(root / name) if (root / name).is_file() else None for name in PATCH_FILES},
|
||
"projectSha256": digest(root / "px_Collect.pro")}, ensure_ascii=False, indent=2))
|
||
|
||
|
||
def ignore_files(directory, names):
|
||
# 不在stage复制在用配置和密钥；测试自行生成临时密钥。
|
||
# 对bin/runtime/logs/build的排除也避免复制采集历史和巨量日志。
|
||
ignored = []
|
||
for name in names:
|
||
lower = name.lower()
|
||
if name in {"bin", "runtime", "logs", "build", "debug", "release", ".git", "__pycache__"} \
|
||
or name.startswith(("Makefile", "moc_", ".qmake")) \
|
||
or lower.endswith((".ini", ".o", ".obj", ".user", ".pyc")) \
|
||
or ("key" in lower and lower.endswith((".json", ".properties"))):
|
||
ignored.append(name)
|
||
return ignored
|
||
|
||
|
||
def payload(args):
|
||
# 逐个读取白名单文件，不调用tar.extract，拒绝目录穿越、链接或重复条目。
|
||
# 文件总数和每项大小均受限，未知条目即使名称看似安全也不接受。
|
||
with tarfile.open(str(args.package), "r:gz") as archive:
|
||
names = archive.getnames()
|
||
if len(names) != len(set(names)) or set(names) != ALLOWED | {"image-route-manifest.json"}:
|
||
raise RuntimeError("Unexpected archive contents")
|
||
content = {}
|
||
for name in names:
|
||
item = archive.getmember(name)
|
||
if not item.isfile() or item.size <= 0 or item.size > 2 * 1024 * 1024:
|
||
raise RuntimeError("Invalid archive entry: " + name)
|
||
content[name] = archive.extractfile(item).read()
|
||
# manifest也受大小和类型约束，只有白名单完整且逐文件哈希匹配才继续。
|
||
manifest = json.loads(content.pop("image-route-manifest.json"))
|
||
if manifest.get("protocol") != "COLLECTOR_IMAGE_ROUTE" or manifest.get("format") != 1:
|
||
raise RuntimeError("Unknown package format")
|
||
if len(manifest.get("files", [])) != len(ALLOWED):
|
||
raise RuntimeError("Manifest entry count is invalid")
|
||
checks = {item["path"]: item["sha256"] for item in manifest["files"]}
|
||
if set(checks) != ALLOWED or any(hashlib.sha256(data).hexdigest() != checks[name]
|
||
for name, data in content.items()):
|
||
raise RuntimeError("Package hash validation failed")
|
||
return content
|
||
|
||
|
||
def project_append(project):
|
||
text = project.read_text(encoding="utf-8")
|
||
# 保留板上已有依赖/DEFINES，尤其GST、日志保留与hiredis真实库位置。
|
||
# 仅补缺少的HEADERS/SOURCES，不拿本机历史pro覆盖当前ARM工程。
|
||
# 注释提到文件名不算真实注册；追加动作仅发生在stage副本。
|
||
uncommented = "\n".join(line.split("#", 1)[0] for line in text.splitlines())
|
||
# 六个编译单元的类型由白名单后缀决定，不接受manifest提供qmake指令。
|
||
additions = []
|
||
for relative in PATCH_FILES:
|
||
if not re.search(r"(?<![A-Za-z0-9_])" + re.escape(relative) + r"(?![A-Za-z0-9_.])", uncommented):
|
||
additions.append(("HEADERS" if relative.endswith(".h") else "SOURCES") + " += " + relative)
|
||
if additions:
|
||
text += "\n# 图片上传地址协商：仅追加编译单元，保留当前板端全部原有依赖。\n"
|
||
text += "\n".join(additions) + "\n"
|
||
project.write_text(text, encoding="utf-8")
|
||
|
||
|
||
def candidate_config(original, gateway, gateway_port, fallback, fallback_port):
|
||
# 使用严格解析检查重复节/键，再只编辑指定键，保留其他值、注释和大小写。
|
||
parser = configparser.ConfigParser(interpolation=None)
|
||
try:
|
||
parser.read_string(original)
|
||
except configparser.Error:
|
||
# INI解析错误可能包含原配置行，禁止把潜在凭证写入部署日志。
|
||
raise RuntimeError("Existing collector INI has unsupported or duplicate entries") from None
|
||
if not parser.getboolean("image_upload", "enabled", fallback=False):
|
||
raise RuntimeError("Existing image_upload must already be enabled")
|
||
# 协商target由可信回复动态决定，此处不写节点IP，也不固定每台节点的路数。
|
||
# 独立fallback_ip是部署必填项，避免fixed_json指向网关后继承错误地址。
|
||
changes = {"image_upload": {"udp_host": fallback, "udp_port": str(fallback_port)},
|
||
"image_negotiation": {"enabled": "true", "gateway_host": gateway,
|
||
"gateway_port": str(gateway_port)}}
|
||
current = None
|
||
result = []
|
||
# seen区分已有节与真正缺失的节，避免生成会被QSettings错误解释的重复配置。
|
||
seen = set()
|
||
|
||
def missing():
|
||
# 原节结束前补缺项，不追加重复节；不会重写fixed_json、heartbeat或RTP。
|
||
if current in changes:
|
||
for key, value in changes[current].items():
|
||
result.append(key + "=" + value)
|
||
changes[current].clear()
|
||
|
||
# 逐行保留未修改设置，避免ConfigParser整份重写丢失现网注释和自定义字段。
|
||
for line in original.splitlines():
|
||
section = re.match(r"^\s*\[([^]]+)\]\s*(?:[;#].*)?$", line)
|
||
if section:
|
||
missing()
|
||
current = section.group(1)
|
||
seen.add(current)
|
||
entry = re.match(r"^\s*([^=;#]+?)\s*=", line)
|
||
key = entry.group(1).strip() if entry else None
|
||
if current in changes and key in changes[current]:
|
||
line = key + "=" + changes[current].pop(key)
|
||
result.append(line)
|
||
missing()
|
||
for section, values in changes.items():
|
||
if values and section not in seen:
|
||
result += ["", "; 节点地址失效回退PXHJ原图入口，不能借用网关作为fallback。", "[" + section + "]"]
|
||
result += [key + "=" + value for key, value in values.items()]
|
||
# 配置只返回字符串，不在此函数触碰生产config.ini。
|
||
return "\n".join(result) + "\n"
|
||
|
||
|
||
def stage(args):
|
||
root = live_root(args)
|
||
archive = payload(args)
|
||
# 默认stage落在工程runtime内且使用唯一ID；已有目录绝不覆盖或递归删除。
|
||
parent = root / "runtime"
|
||
parent.mkdir(exist_ok=True)
|
||
if parent.is_symlink():
|
||
raise RuntimeError("Runtime directory cannot be a symbolic link")
|
||
directory = parent / ("image-route-stage-" + time.strftime("%Y%m%d-%H%M%S") + "-" + uuid.uuid4().hex[:8])
|
||
# stage私有权限保护原配置备份；候选config另设600权限。
|
||
directory.mkdir(mode=0o700)
|
||
source = directory / "source"
|
||
# 由当前板端源码和SDK创建隔离副本，不在生产源目录做增量make。
|
||
# 保留相对库链接；后续所有写入路径还会核对没有经过链接逃出stage。
|
||
shutil.copytree(root, source, symlinks=True, ignore=ignore_files)
|
||
required = {"main.cpp": "CollectorLogRetention::install",
|
||
"px_Collect.pro": "COLLECTOR_WITH_GST",
|
||
"Go2Controller/network/rtpreceiver.cpp": "PlatformImageSender",
|
||
"Fly2Controller/network/RtpReceiver.cpp": "PlatformImageSender"}
|
||
# 发现旧工程缺少既有内置日志或JPG收流链路时停止，不能静默退回旧功能。
|
||
# 操作者需先审阅差异并合并当前源码，不能让本工具盲目覆盖main或RTP文件。
|
||
for relative, marker in required.items():
|
||
path = source / relative
|
||
if not path.is_file() or marker not in path.read_text(encoding="utf-8"):
|
||
raise RuntimeError("Required existing feature missing: " + relative)
|
||
# 记录当前板的受保留源码，build再次确认副本没有被覆盖为旧版本。
|
||
baseline = {name: digest(root / name) for name in PRESERVED if (root / name).is_file()}
|
||
# stage失败时留存证据目录，不自动删除备份或任何生产文件。
|
||
previous = {name: digest(root / name) if (root / name).is_file() else None for name in PATCH_FILES}
|
||
backup = directory / "backup"
|
||
backup.mkdir(mode=0o700)
|
||
# 切换前回退材料提前保存；备份config为私有文件，不打印其中任何内容。
|
||
for relative in PATCH_FILES + ("px_Collect.pro", "bin/px_JKGL", "config.ini"):
|
||
live = root / relative
|
||
if live.is_symlink() or not live.parent.resolve().is_relative_to(root):
|
||
raise RuntimeError("Unexpected live symbolic link: " + relative)
|
||
if live.is_file():
|
||
destination = backup / relative
|
||
destination.parent.mkdir(parents=True, exist_ok=True)
|
||
shutil.copy2(live, destination)
|
||
os.chmod(str(backup / "config.ini"), 0o600)
|
||
# 仅写副本白名单；在用util源码保持原样直到root执行已授权切换。
|
||
for name, data in archive.items():
|
||
destination = source / name
|
||
if destination.is_symlink() or not destination.parent.resolve().is_relative_to(source.resolve()):
|
||
raise RuntimeError("Unexpected stage symbolic link: " + name)
|
||
destination.parent.mkdir(parents=True, exist_ok=True)
|
||
destination.write_bytes(data)
|
||
project_append(source / "px_Collect.pro")
|
||
# 图片fallback单独指定PXHJ，不读取或改变固定采集目标来猜测原图目的地。
|
||
config = candidate_config((root / "config.ini").read_text(encoding="utf-8-sig"),
|
||
args.gateway_host, args.gateway_port, args.fallback_ip, args.fallback_port)
|
||
candidate = directory / "candidate-config.ini"
|
||
# 协商enabled=true只进入候选配置，此时当前程序仍读取原配置。
|
||
candidate.write_text(config, encoding="utf-8")
|
||
os.chmod(str(candidate), 0o600)
|
||
# 元数据只含文件哈希和路径，回退材料与候选config均由stage目录权限保护。
|
||
# 原来不存在的新文件以None记录，切换时不会把新增与覆盖混为一谈。
|
||
metadata = {"format": 1, "root": str(root), "stage": str(directory),
|
||
"packageSha256": digest(args.package), "previousPatchHashes": previous,
|
||
"preservedHashes": baseline, "previousProjectSha256": digest(root / "px_Collect.pro"),
|
||
"previousBinarySha256": digest(root / "bin/px_JKGL"),
|
||
"previousConfigSha256": digest(root / "config.ini"),
|
||
"candidateConfigSha256": digest(candidate),
|
||
"candidatePatchHashes": {name: digest(source / name) for name in PATCH_FILES},
|
||
"candidateProjectSha256": digest(source / "px_Collect.pro"), "built": False}
|
||
write_json(directory / "stage.json", metadata)
|
||
print(json.dumps({"stage": str(directory), "liveChanged": False,
|
||
"backup": str(backup), "candidateConfig": str(candidate)}, ensure_ascii=False))
|
||
|
||
|
||
def stage_record(args):
|
||
root = live_root(args)
|
||
# 构建与回退都必须绑定创建时的root/stage身份，不能复用别的工程记录。
|
||
if args.stage.is_symlink():
|
||
raise RuntimeError("Stage directory cannot be a symbolic link")
|
||
directory = args.stage.resolve(strict=True)
|
||
if not directory.is_relative_to((root / "runtime").resolve()) or directory == root / "runtime":
|
||
raise RuntimeError("Stage must stay inside the collector runtime directory")
|
||
# 不根据文件名猜测stage所属，记录内的绝对路径必须和当前解析结果相同。
|
||
record = json.loads((directory / "stage.json").read_text(encoding="utf-8"))
|
||
if record.get("root") != str(root) or record.get("stage") != str(directory):
|
||
raise RuntimeError("Stage record does not match its target root")
|
||
# 返回规范化路径供build/verify/rollback共用，防止作用范围逐步漂移。
|
||
return root, directory, record
|
||
|
||
|
||
def verify(args):
|
||
root, directory, record = stage_record(args)
|
||
# 任一在用源码/程序/配置从stage以后改变，就停止，不能覆盖更新后的版本。
|
||
# 新文件原本不存在也要记录：出现外部新增版本时同样不能覆盖。
|
||
expected = dict(record["preservedHashes"])
|
||
expected.update(record["previousPatchHashes"])
|
||
expected.update({"px_Collect.pro": record["previousProjectSha256"],
|
||
"bin/px_JKGL": record["previousBinarySha256"], "config.ini": record["previousConfigSha256"]})
|
||
# 不打印任何差异内容，仅报告路径；例如config变化不能泄漏其中的凭证。
|
||
changed = [name for name, value in expected.items()
|
||
if (digest(root / name) if (root / name).is_file() else None) != value]
|
||
if changed:
|
||
raise RuntimeError("Live files changed since staging: " + ", ".join(changed))
|
||
print(json.dumps({"stage": str(directory), "liveUnchanged": True, "built": record["built"]}))
|
||
|
||
|
||
def run_logged(command, cwd, log):
|
||
# 不通过shell拼接命令，参数中的路径作为独立argv传递。
|
||
# check=True保证失败停止后续步骤，不把半编译候选标成built。
|
||
# 构建输出只写stage日志，失败保留全部证据；不占用原run.log预算。
|
||
with log.open("wb") as stream:
|
||
subprocess.run(command, cwd=str(cwd), stdout=stream, stderr=subprocess.STDOUT, check=True)
|
||
|
||
|
||
def build(args):
|
||
# 本机Windows测试不能代替全ARM工程，本模式明确限定aarch64环境。
|
||
# 当前代码不提供任何去掉相机/GStreamer/日志依赖来勉强构建的降级分支。
|
||
root, directory, record = stage_record(args)
|
||
if platform.machine() not in {"aarch64", "arm64"}:
|
||
raise RuntimeError("Full application build must run on the ARM64 target environment")
|
||
# build前再次核对生产文件没被其他部署修改，避免基于陈旧源生成候选。
|
||
verify(args)
|
||
source = directory / "source"
|
||
# 源码保留核对发生在任何qmake/make之前，避免事后才发现构建了旧main。
|
||
for name in PRESERVED:
|
||
if name in record["preservedHashes"] and digest(source / name) != record["preservedHashes"][name]:
|
||
raise RuntimeError("Preserved staged source changed: " + name)
|
||
build_dir = directory / "build"
|
||
build_dir.mkdir(exist_ok=True)
|
||
# 空本地stash防止继承祖先缓存；不修改板上已用工程的.qmake.stash。
|
||
(build_dir / ".qmake.stash").touch()
|
||
run_logged(["qmake", str(source / "px_Collect.pro"), "-after", "INCLUDEPATH+=" + str(source)],
|
||
build_dir, directory / "qmake.log")
|
||
# 已知板时钟可能早于Qt依赖，阻止Makefile自身反复重生成，但正常编译依赖仍保留。
|
||
run_logged(["make", "-o", "Makefile", "-j" + str(args.jobs)], build_dir, directory / "build.log")
|
||
# qmake的PWD是隔离source，DESTDIR因此只写stage/source/bin，生产bin不变。
|
||
executable = source / "bin/px_JKGL"
|
||
if not executable.is_file() or not os.access(str(executable), os.X_OK):
|
||
raise RuntimeError("Full build did not produce an executable")
|
||
# ldd只检查候选库可解析；LD_LIBRARY_PATH沿用当前启动脚本的SDK/hiredis路径。
|
||
environment = dict(os.environ)
|
||
environment["LD_LIBRARY_PATH"] = str(root / "3rdparty/libs") + ":/usr/local/lib/pt_libs:" + environment.get("LD_LIBRARY_PATH", "")
|
||
# 子进程环境不输出到日志，只保留ldd给出的库路径和解析结果。
|
||
linked = subprocess.run(["ldd", str(executable)], env=environment, capture_output=True, text=True, check=True)
|
||
(directory / "ldd.log").write_text(linked.stdout, encoding="utf-8")
|
||
# 可执行文件存在不代表能启动，未解析的相机/Qt/hiredis库必须在切换前处理。
|
||
if "not found" in linked.stdout:
|
||
raise RuntimeError("Candidate has unresolved shared libraries; inspect staged ldd.log")
|
||
# 原日志测试证明预算与入口不退化；协商测试证明回程、租约和原图协议。
|
||
for name, project, executable_name in (
|
||
("logging", "native_logging_check", "native_logging_check"),
|
||
("image_route", "native_image_route_check", "native_image_route_check"),
|
||
):
|
||
test_dir = directory / ("test-" + name)
|
||
test_dir.mkdir(exist_ok=True)
|
||
(test_dir / ".qmake.stash").touch()
|
||
run_logged(["qmake", str(source / "tests" / name / (project + ".pro"))],
|
||
test_dir, directory / (name + "-qmake.log"))
|
||
# 测试也遵守目标板时钟限制，不改系统时间来规避工具链问题。
|
||
run_logged(["make", "-o", "Makefile", "-j" + str(args.jobs)],
|
||
test_dir, directory / (name + "-build.log"))
|
||
# 只运行隔离QtTest，不启动候选主程序，所以不会抢6000/9200或产生真实数据。
|
||
run_logged([str(test_dir / executable_name), "-o", str(directory / (name + "-tests.txt")) + ",txt"],
|
||
test_dir, directory / (name + "-run.log"))
|
||
# 只有完整程序、动态库检查和两套隔离测试都成功才记录built。
|
||
# 准备原图与迁移的业务验收仍需root通过真实PXHJ执行，不能由此标为完成。
|
||
record.update({"built": True, "candidateBinary": str(executable),
|
||
"candidateBinarySha256": digest(executable)})
|
||
# built标记仅描述候选准备，实际部署和业务验收还未由本工具执行。
|
||
write_json(directory / "stage.json", record)
|
||
print(json.dumps({"stage": str(directory), "buildPassed": True, "liveChanged": False,
|
||
"candidateBinary": str(executable), "candidateBinarySha256": digest(executable)}))
|
||
|
||
|
||
def arguments():
|
||
# 默认inspect，防止操作者漏写模式便执行任何准备或构建写入。
|
||
# 所有stage参数都显式给出，不沿用历史部署的IP猜测当前网卡状态。
|
||
parser = argparse.ArgumentParser(description=__doc__)
|
||
parser.add_argument("mode", choices=("package", "inspect", "stage", "build", "verify"), nargs="?", default="inspect")
|
||
parser.add_argument("--source", type=Path, default=Path("E:/Codex/qrs/SY_26_PX_Collect"))
|
||
parser.add_argument("--root", type=Path, default=Path("/home/Tronlong/SY26-PX-Collect"))
|
||
parser.add_argument("--package", type=Path)
|
||
parser.add_argument("--stage", type=Path)
|
||
parser.add_argument("--gateway-host")
|
||
parser.add_argument("--gateway-port", type=int, default=19002)
|
||
parser.add_argument("--fallback-ip")
|
||
parser.add_argument("--fallback-port", type=int, default=6020)
|
||
parser.add_argument("--jobs", type=int, default=4)
|
||
# mode本身就是明确操作入口；本脚本没有activate或自动启动功能。
|
||
args = parser.parse_args()
|
||
if args.mode in {"package", "stage"} and args.package is None:
|
||
parser.error("--package is required")
|
||
if args.mode in {"build", "verify"} and args.stage is None:
|
||
parser.error("--stage is required")
|
||
if not 1 <= args.jobs <= 16 or any(not 1 <= port <= 65535 for port in (args.gateway_port, args.fallback_port)):
|
||
parser.error("Invalid build jobs or UDP port")
|
||
if args.mode == "stage":
|
||
# 禁止DNS猜测和广播，gateway及fallback必须由root明确给出当前部署IP。
|
||
for name, value in (("gateway-host", args.gateway_host), ("fallback-ip", args.fallback_ip)):
|
||
try:
|
||
address = ipaddress.IPv4Address(value)
|
||
if address.is_unspecified or address.is_multicast or int(address) == 0xffffffff:
|
||
raise ValueError()
|
||
except (ValueError, TypeError):
|
||
parser.error("--" + name + " must be an explicit unicast IPv4 address")
|
||
return args
|
||
|
||
|
||
if __name__ == "__main__":
|
||
options = arguments()
|
||
{"package": package, "inspect": inspect, "stage": stage, "build": build, "verify": verify}[options.mode](options)
|