refactor(evidence): share inventory producer primitives

noxfile.py

@@ -27,6 +27,8 @@
 
 from __future__ import annotations
 
+import hashlib
+import json
 from pathlib import Path
 import shutil
 import sys
@@ -572,6 +574,50 @@ def _distributions(session: nox.Session) -> None:
             IMPORT_PACKAGE,
             env={"PYTHONPATH": "", "PYTHONSAFEPATH": "1"},
         )
+        verifier_bundle = workdir / "verifier-bundle"
+        if verifier_bundle.exists():
+            shutil.rmtree(verifier_bundle)
+        verifier_bundle.mkdir()
+        verifier_payload = b"installed verifier probe\n"
+        (verifier_bundle / "evidence.bin").write_bytes(verifier_payload)
+        (verifier_bundle / "inventory.json").write_text(
+            json.dumps(
+                {
+                    "artifacts": [
+                        {
+                            "media_type": "application/octet-stream",
+                            "path": "evidence.bin",
+                            "sha256": hashlib.sha256(verifier_payload).hexdigest(),
+                            "size_bytes": len(verifier_payload),
+                        }
+                    ]
+                },
+                indent=2,
+                sort_keys=True,
+            )
+            + "\n",
+            encoding="utf-8",
+        )
+        _run(
+            session,
+            str(venv / "bin" / "raes-adapters"),
+            "verify-bundle",
+            "--bundle",
+            str(verifier_bundle),
+            "--format",
+            "json",
+            env={"PYTHONPATH": "", "PYTHONSAFEPATH": "1"},
+        )
+        (verifier_bundle / "evidence.bin").write_bytes(b"tampered\n")
+        _run(
+            session,
+            str(venv / "bin" / "raes-adapters"),
+            "verify-bundle",
+            "--bundle",
+            str(verifier_bundle),
+            success_codes=[3],
+            env={"PYTHONPATH": "", "PYTHONSAFEPATH": "1"},
+        )
 
     session.log("clean install: cyberbattlesim extra conformance")
     conformance_venv = workdir / "venv-cyberbattlesim"

pyproject.toml

@@ -67,7 +67,7 @@ cyborg = ["raes-env-packs==3.6.2"]
 nasim = ["nasim==0.12.0", "gymnasium==0.26.3", "numpy==1.26.4", "raes-env-packs==3.6.2"]
 
 [project.scripts]
-raes-adapters = "raes_adapters.cli:main"
+raes-adapters = "raes_adapters.entrypoint:main"
 
 [project.urls]
 Homepage = "https://github.com/OpenRAE/adapters"
@@ -124,6 +124,7 @@ select = ["E", "F", "I", "UP", "B", "SIM", "C4"]
 "src/raes_adapters/_gym_backend/provisioner.py" = ["UP004"]
 "src/raes_adapters/_gym_backend/evaluator.py" = ["UP004"]
 "src/raes_adapters/_gym_backend/participant_runtime.py" = ["UP004"]
+"src/raes_adapters/bundle_verifier.py" = ["UP004"]
 "src/raes_adapters/cyberbattlesim/backend/driver.py" = ["UP004"]
 "src/raes_adapters/cyberbattlesim/backend/evaluator.py" = ["UP004"]
 "src/raes_adapters/cyberbattlesim/backend/orchestrator.py" = ["UP004"]

src/raes_adapters/_inventory.py

@@ -0,0 +1,61 @@
+"""Private byte-level inventory primitives shared by adapter producers.
+
+This module describes files, not experiment meaning. It deliberately imports
+neither simulators nor RAES contracts and defines no portable schema.
+"""
+
+from __future__ import annotations
+
+import hashlib
+from collections.abc import Callable, Iterable
+from pathlib import Path
+
+
+def media_type(path: Path) -> str:
+    """Return the established portable media type for a produced artifact."""
+
+    return "application/json" if path.suffix == ".json" else "application/octet-stream"
+
+
+def inventory_entry(
+    root: Path,
+    path: Path,
+    *,
+    type_name: str | None = None,
+) -> dict[str, object]:
+    """Describe one regular contained file with the established entry shape."""
+
+    resolved_root = root.resolve()
+    if path.is_symlink() or not path.is_file():
+        raise ValueError("inventory member is not a regular file")
+    resolved_path = path.resolve()
+    if not resolved_path.is_relative_to(resolved_root):
+        raise ValueError("inventory member escapes its root")
+    try:
+        relative = path.relative_to(root).as_posix()
+    except ValueError as error:
+        raise ValueError("inventory member escapes its root") from error
+    content = path.read_bytes()
+    return {
+        "media_type": type_name if type_name is not None else media_type(path),
+        "path": relative,
+        "sha256": hashlib.sha256(content).hexdigest(),
+        "size_bytes": len(content),
+    }
+
+
+def inventory_document(
+    root: Path,
+    members: Iterable[Path],
+    *,
+    type_for: Callable[[Path], str] = media_type,
+) -> dict[str, object]:
+    """Build a deterministic inventory document without writing it."""
+
+    ordered = sorted(members, key=lambda item: item.relative_to(root).as_posix())
+    return {
+        "artifacts": [inventory_entry(root, path, type_name=type_for(path)) for path in ordered]
+    }
+
+
+__all__ = ["inventory_document", "inventory_entry", "media_type"]