| 1 | import requests |
| 2 | import json |
| 3 | import sys |
| 4 | import hashlib |
| 5 | import difflib |
| 6 | from urllib.request import urlretrieve |
| 7 | from xml.etree import ElementTree |
| 8 | import tempfile |
| 9 | import zipfile |
| 10 | |
| 11 | def download_and_get_manifest(url: str): |
| 12 | print(f'Downloading {url}') |
| 13 | |
| 14 | filename, _ = urlretrieve(url) |
| 15 | with zipfile.ZipFile(filename) as archive: |
| 16 | try: |
| 17 | with archive.open('AppxManifest.xml') as manifest: |
| 18 | return ElementTree.fromstring(manifest.read()) |
| 19 | except KeyError: |
| 20 | # In the case of a bundle |
| 21 | with archive.open('AppxMetadata/AppxBundleManifest.xml') as manifest: |
| 22 | return ElementTree.fromstring(manifest.read()) |
| 23 | |
| 24 | def validate_package_url(url: str, family_name: str, platform: str): |
| 25 | manifest = download_and_get_manifest(url) |
| 26 | identity = manifest.find('.//{http://schemas.microsoft.com/appx/manifest/foundation/windows10}Identity') |
| 27 | dependencies = manifest.find('.//{http://schemas.microsoft.com/appx/manifest/foundation/windows10}PackageDependency') |
| 28 | if identity is not None: |
| 29 | # Check the architecture if the package isn't bundled |
| 30 | assert platform == identity.attrib['ProcessorArchitecture'] |
| 31 | else: |
| 32 | # Only check the package name for bundles |
| 33 | identity = manifest.find('.//{http://schemas.microsoft.com/appx/2013/bundle}Identity') |
| 34 | dependencies = manifest.find('.//{http://schemas.microsoft.com/appx/2013/bundle}PackageDependency') |
| 35 | |
| 36 | # Packages uploaded to the CDN shouldn't have dependencies since they can't be installed automatically on Server SKU's. |
| 37 | assert dependencies is None |
| 38 | |
| 39 | # Validate the package family_name (the last part is based on a custom hash of the publisher) |
| 40 | publisher_hash = hashlib.sha256(identity.attrib['Publisher'].encode('utf-16le')).digest()[:8] |
| 41 | encoded_string = ''.join(['{0:b}'.format(e).rjust(8, '0') for e in publisher_hash] + ['0']) |
| 42 | encoded_hash = '' |
| 43 | charset = "0123456789abcdefghjkmnpqrstvwxyz" |
| 44 | for i in range(0, len(encoded_string), 5): |
| 45 | encoded_hash += charset[int(encoded_string[i:i + 5], 2)] |
| 46 | |
| 47 | assert family_name.startswith(identity.attrib["Name"]) |
| 48 | assert family_name.endswith('_' + encoded_hash) |
| 49 | |
| 50 | def validate_distro(distro: dict): |
| 51 | if distro['Amd64PackageUrl'] is not None: |
| 52 | validate_package_url(distro['Amd64PackageUrl'], distro['PackageFamilyName'], 'x64') |
| 53 | |
| 54 | if distro['Arm64PackageUrl'] is not None: |
| 55 | validate_package_url(distro['Arm64PackageUrl'], distro['PackageFamilyName'], 'arm64') |
| 56 | |
| 57 | def is_unique(collection: list): |
| 58 | unique_list = set(collection) |
| 59 | return len(collection) == len(unique_list) |
| 60 | |
| 61 | |
| 62 | if __name__ == "__main__": |
| 63 | if len(sys.argv) < 2: |
| 64 | print(f'Usage: {sys.argv[0]} /path/to/file [distroName]', file=sys.stderr) |
| 65 | exit(1) |
| 66 | |
| 67 | with open(sys.argv[1]) as fd: |
| 68 | data = fd.read() |
| 69 | content = json.loads(data) |
| 70 | diff = difflib.unified_diff( |
| 71 | data.splitlines(keepends=True), |
| 72 | (json.dumps(content, indent=4) + "\n").splitlines(keepends=True), |
| 73 | fromfile="a" + sys.argv[1], |
| 74 | tofile="b" + sys.argv[1], |
| 75 | ) |
| 76 | diff = "".join(diff) |
| 77 | assert diff == "", diff |
| 78 | |
| 79 | distros = content['Distributions'] |
| 80 | assert is_unique([e.get('StoreAppId') for e in distros if e]) |
| 81 | assert is_unique([e.get('Name') for e in distros if e]) |
| 82 | |
| 83 | if len(sys.argv) > 2: |
| 84 | # Filter the distros to only the one we want to validate |
| 85 | content = { "Distributions": [e for e in content['Distributions'] if e['Name'] == sys.argv[2]] } |
| 86 | if not content['Distributions']: |
| 87 | raise RuntimeError(f'No distro found for name {sys.argv[2]}') |
| 88 | |
| 89 | |
| 90 | for e in content['Distributions']: |
| 91 | validate_distro(e) |
| 92 | |
| 93 | print("All checks completed successfully") |