Add logic to validate the last part of the package family name in validate.py (#9280)
Blue committed
Dec 8, 2022 at 15:47 UTC
e4d3cf3680469dd0611c880f1b9dd81c6131c3fd
1 file changed
+13
-2
distributions/validate.py
+13
-2
@@ -1,6 +1,8 @@
1
import requests
2
import json
3
import sys
4
+import hashlib
5
+import base64
6
from urllib.request import urlretrieve
7
from xml.etree import ElementTree
8
import tempfile
@@ -31,11 +33,20 @@ def validate_package_url(url: str, family_name: str, platform: str):
33
identity = manifest.find('.//{http://schemas.microsoft.com/appx/2013/bundle}Identity')
34
dependencies = manifest.find('.//{http://schemas.microsoft.com/appx/2013/bundle}PackageDependency')
35
34
- assert identity.attrib['Name'] in family_name
35
-
36
# Packages uploaded to the CDN shouldn't have dependencies since they can't be installed automatically on Server SKU's.
37
assert dependencies is None
38
39
+ # Validate the package family_name (the last part is based on a custom hash of the publisher)
40
+ publisher_hash = hashlib.sha256(identity.attrib['Publisher'].encode('utf-16le')).digest()[:8]
41
+ encoded_string = ''.join(['{0:b}'.format(e).rjust(8, '0') for e in publisher_hash] + ['0'])
42
+ encoded_hash = ''
43
+ charset = "0123456789abcdefghjkmnpqrstvwxyz"
44
+ for i in range(0, len(encoded_string), 5):
45
+ encoded_hash += charset[int(encoded_string[i:i + 5], 2)]
46
+
47
+ assert family_name.startswith(identity.attrib["Name"])
48
+ assert family_name.endswith('_' + encoded_hash)
49
+
50
def validate_distro(distro: dict):
51
if distro['Amd64PackageUrl'] is not None:
52
validate_package_url(distro['Amd64PackageUrl'], distro['PackageFamilyName'], 'x64')