mirror of
https://github.com/azaion/gps-denied-onboard.git
synced 2026-06-21 19:51:12 +00:00
Oleksandr Bezdieniezhnykh
b12db61444
Implements the AZ-263 / E-BOOT initial structure task:
- Python src/-layout package `gps_denied_onboard/` with per-component
interface stubs (14 components), type-only DTOs under `_types/`,
shared helpers under `helpers/` (R14 LightGlue ownership), structured
JSON logging, runtime composition root with env-var fail-fast gate,
healthcheck module shared by Docker and CI smoke.
- CMake top-level + `cmake/{build_options,dependencies,strategies}.cmake`
with the BUILD_* per-binary flags (ADR-002) and pinned external git
refs for OKVIS2 / VINS-Mono / GTSAM / FAISS / OpenCV >=4.12.0.
- Three Dockerfiles (companion-tier1, operator-tooling,
mock-suite-sat-service) + two compose files (dev + Tier-1 test).
- Four GitHub Actions workflows: ci.yml (lint/unit/integration/dual
binary build/SBOM diff/security), ci-tier2.yml (self-hosted Jetson
AC-bound NFTs), release.yml, cve-rescan.yml.
- Two CI gate scripts: `ci/sbom_diff.py` (deployment SBOM subset +
R02 exclusion), `ci/opencv_pin_gate.py` (>=4.12.0 enforcement,
D-CROSS-CVE-1).
- Alembic-driven Postgres 16 initial migration `0001_initial.py`
mirroring satellite-provider tiles + flights + sector_classifications
+ manifests + engine_cache_entries (data_model.md s 2).
- Tier-1 test scaffolding: 95 passing unit tests covering every AC,
per-component smoke tests, structured logging JSON output check,
env-var gate check, healthcheck import check. Two CI-gated tests
(cmake configure, actionlint) skip locally with explicit reasons.
- Batch report + code review report under `_docs/03_implementation/`.
Verdict: PASS_WITH_WARNINGS (two Low findings, both informational).
Co-authored-by: Cursor <cursoragent@cursor.com>
80 lines
2.7 KiB
Python
Executable File
80 lines
2.7 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""SBOM diff — ADR-002 build-time exclusion enforcement.
|
|
|
|
Asserts that the **deployment** SBOM is a strict subset of the **research** SBOM
|
|
and that the deployment SBOM does NOT contain components excluded for airborne
|
|
builds (R02 enforcement: `vins_mono`, `salad`, `c11_tile_manager`).
|
|
|
|
Bootstrap (AZ-263) ships the executable with a JSON-array contract so the CI
|
|
step can validate even before the build pipeline emits real SBOMs.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
EXCLUDED_FROM_DEPLOYMENT = frozenset({"vins_mono", "salad", "c11_tile_manager"})
|
|
|
|
|
|
def _component_name(item: object) -> str:
|
|
"""Extract a component name from any of the accepted SBOM item shapes."""
|
|
if isinstance(item, str):
|
|
return item
|
|
if isinstance(item, dict):
|
|
name = item.get("name")
|
|
if isinstance(name, str) and name:
|
|
return name
|
|
# CycloneDX-style `purl` (e.g. `pkg:pypi/numpy@1.26.4`).
|
|
purl = item.get("purl")
|
|
if isinstance(purl, str) and "/" in purl:
|
|
return purl.split("/", 1)[1].split("@", 1)[0]
|
|
raise ValueError(f"Cannot extract component name from SBOM item: {item!r}")
|
|
|
|
|
|
def _load_components(path: Path) -> set[str]:
|
|
if not path.exists():
|
|
return set()
|
|
data = json.loads(path.read_text())
|
|
if isinstance(data, list):
|
|
return {_component_name(c) for c in data}
|
|
if isinstance(data, dict) and "components" in data:
|
|
components = data["components"]
|
|
if isinstance(components, list):
|
|
return {_component_name(c) for c in components}
|
|
raise ValueError(f"Unrecognised SBOM shape in {path}")
|
|
|
|
|
|
def main(argv: list[str] | None = None) -> int:
|
|
parser = argparse.ArgumentParser(description="Deployment ⊂ Research SBOM diff (ADR-002).")
|
|
parser.add_argument("--deployment", type=Path, required=True)
|
|
parser.add_argument("--research", type=Path, required=True)
|
|
args = parser.parse_args(argv)
|
|
|
|
deployment = _load_components(args.deployment)
|
|
research = _load_components(args.research)
|
|
|
|
extras = deployment - research
|
|
forbidden = deployment & EXCLUDED_FROM_DEPLOYMENT
|
|
|
|
if extras:
|
|
print(
|
|
f"FAIL: deployment SBOM has components not in research: {sorted(extras)}",
|
|
file=sys.stderr,
|
|
)
|
|
if forbidden:
|
|
print(
|
|
f"FAIL: deployment SBOM contains forbidden components: {sorted(forbidden)}",
|
|
file=sys.stderr,
|
|
)
|
|
if extras or forbidden:
|
|
return 1
|
|
print("OK: deployment ⊂ research and no R02-excluded components present.")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|