File size: 626 Bytes
83e1c23 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 | """Verify and unpack the trusted, pinned pipeline bundle before running a job."""
import hashlib
import json
import tarfile
from pathlib import Path
def unpack(app, destination):
archive = app / "pipeline-source.tar.gz"
version = json.loads((app / "pipeline-version.json").read_text())
if hashlib.sha256(archive.read_bytes()).hexdigest() != version["sha256"]:
raise RuntimeError("Pipeline archive checksum mismatch")
with tarfile.open(archive) as bundle:
bundle.extractall(destination, filter="data")
if __name__ == "__main__":
unpack(Path(__file__).parent, Path("/workspace/source"))
|