1"""Check that the lab never edits the upstream Hermes source files."""23import hashlib4import json5from pathlib import Path6import sys78ROOT = Path("/opt/hermes")9MANIFEST = Path("/opt/hermes-source.json")101112def record():13 files = {}14 for path in sorted(ROOT.rglob("*")):15 if path.is_file() and not path.is_symlink():16 files[str(path.relative_to(ROOT))] = hashlib.sha256(path.read_bytes()).hexdigest()17 MANIFEST.write_text(json.dumps(files, sort_keys=True))181920def verify():21 changed = []22 for name, expected in json.loads(MANIFEST.read_text()).items():23 path = ROOT / name24 if not path.is_file() or hashlib.sha256(path.read_bytes()).hexdigest() != expected:25 changed.append(name)26 if changed:27 raise SystemExit("Upstream Hermes files changed: " + ", ".join(changed[:20]))28 print("Unmodified Hermes source verified: " + Path("/opt/hermes-revision").read_text().strip())293031if __name__ == "__main__":32 {"record": record, "verify": verify}[sys.argv[1]]()