434 lines
17 KiB
Python
434 lines
17 KiB
Python
#!/usr/bin/env python3
|
||
# -*- coding: utf-8 -*-
|
||
"""
|
||
forge_repo_staging.py — генерирует публичный репозиторий с 500+ коммитами.
|
||
Строка mesh: "OH-21B4" и base64-флаг встречаются РОВНО в одном коммите ветки
|
||
`staging/router-mesh`. В main их нет (ветка смёржена через --squash).
|
||
Можно сразу запушить: python3 forge_repo_staging.py --push <git-url>
|
||
Или задать автора: --author-name "Имя" --author-email you@example.com
|
||
"""
|
||
|
||
import os, sys, json, random, subprocess, shutil, argparse, base64, re
|
||
from datetime import datetime, timedelta, timezone
|
||
|
||
# -------- параметры по умолчанию --------
|
||
REPO_NAME = "iot-suite-repo-mega-fixed"
|
||
BRANCH_SECRET = "staging/router-mesh"
|
||
FEATURE_BRANCHES = [
|
||
("feature/ui-polish", 6),
|
||
("hotfix/diag-timeout", 3),
|
||
("refactor/router-cfg", 5),
|
||
]
|
||
MAIN_COMMITS = 520 # шумовых коммитов в main
|
||
TIME_START = datetime(2023, 3, 1, 10, 0, tzinfo=timezone(timedelta(hours=1)))
|
||
STEP_MAIN = timedelta(hours=6)
|
||
STEP_BRANCH = timedelta(hours=2)
|
||
|
||
AUTHORS_DEFAULT = [
|
||
("Natalie Orlov", "natalie@orbital.home"),
|
||
("Anton Lebedev", "anton@orbital.home"),
|
||
("Nina Petrova", "nina@orbital.home"),
|
||
("Mark Isaev", "mark@orbital.home"),
|
||
("QA Bot", "qa-bot@orbital.home"),
|
||
]
|
||
|
||
NOISE_MESSAGES = [
|
||
"docs: update changelog", "chore: reformat", "ci: bump node action",
|
||
"router: refactor logger", "kettle: tweak diag", "nas: session cleanup",
|
||
"printer: queue cosmetics", "deps: bump ejs", "deps: bump express",
|
||
"test: deflake", "build: docker cache", "perf: micro-opt",
|
||
"style: trailing space", "docs: badges",
|
||
]
|
||
|
||
FLAG_PLAINTEXT = "caplag{Orb1ta1-h0me-vendor-found-needed-branch-version}"
|
||
FLAG_B64 = base64.b64encode(FLAG_PLAINTEXT.encode()).decode()
|
||
|
||
def sh(args, cwd=None, env=None):
|
||
return subprocess.run(args, cwd=cwd, env=env, check=True,
|
||
stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True).stdout.strip()
|
||
|
||
def write(path, content, binary=False):
|
||
os.makedirs(os.path.dirname(path), exist_ok=True)
|
||
mode = "wb" if (binary or isinstance(content, (bytes, bytearray))) else "w"
|
||
with open(path, mode, encoding=None if mode=="wb" else "utf-8") as f:
|
||
f.write(content)
|
||
|
||
BASE_README = """# Orbital Home — IoT Suite (public)
|
||
Публичная версия кодовой базы для демонстраций: Router, Printer, Kettle, NAS.
|
||
Документация и закрытые части вырезаны.
|
||
"""
|
||
|
||
# ---------------- router (публичный минимальный) ----------------
|
||
ROUTER_SERVER = """import express from 'express';
|
||
import fs from 'fs';
|
||
import path from 'path';
|
||
import { fileURLToPath } from 'url';
|
||
|
||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||
const app = express();
|
||
const PORT = process.env.PORT || 8085;
|
||
|
||
const cfgPath = path.join(__dirname, 'config', 'router.json');
|
||
let cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
|
||
|
||
app.get('/info_connection', (req,res)=>{
|
||
res.json({ devices: [
|
||
{ name:'Printer', model:'PRN-3130', vendor: cfg.vendor, mesh: cfg.mesh, url: 'http://printer.local' },
|
||
{ name:'Kettle', model:'KTL-74C1', vendor: cfg.vendor, mesh: cfg.mesh, url: 'http://kettle.local' },
|
||
{ name:'NAS', model:'NAS-220', vendor: cfg.vendor, mesh: cfg.mesh, url: 'http://nas.local' }
|
||
]});
|
||
});
|
||
|
||
app.get('/', (req,res)=> res.type('text/plain').send('Router UI (public build)'));
|
||
app.listen(PORT, ()=> console.log(`[router-public] listening on ${PORT}`));
|
||
"""
|
||
|
||
ROUTER_PKG = {
|
||
"name":"router-public","version":"0.3.0","type":"module",
|
||
"scripts":{"start":"node server.js"},
|
||
"dependencies":{"express":"^4.19.2"}
|
||
}
|
||
|
||
# ---------------- printer (замаскированный) ----------------
|
||
PRINTER_SERVER_PUBLIC = """import express from 'express';
|
||
import fs from 'fs';
|
||
import path from 'path';
|
||
import { fileURLToPath } from 'url';
|
||
|
||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||
const app = express();
|
||
const PORT = process.env.PORT || 8080;
|
||
const QUEUE_DIR = path.join(__dirname, 'data', 'queue');
|
||
|
||
// <redacted>: private build may include additional endpoints and auth
|
||
|
||
app.get('/', (req,res)=> res.type('text/plain').send('Printer UI (public build)'));
|
||
|
||
app.get('/jobs/preview', (req,res)=>{
|
||
const name = String(req.query.file||'').replace(/\\\\/g,'/');
|
||
if (!name || name.includes('..') || path.isAbsolute(name)) return res.status(400).send('bad path');
|
||
const abs = path.join(QUEUE_DIR, path.normalize(name));
|
||
if (!abs.startsWith(QUEUE_DIR)) return res.status(400).send('bad path');
|
||
if (!fs.existsSync(abs)) return res.status(404).send('not found');
|
||
fs.createReadStream(abs).pipe(res);
|
||
});
|
||
|
||
app.get('/go', (req,res)=>{
|
||
const u = String(req.query.u||'');
|
||
if (/^https?:\\/\\//i.test(u)) return res.redirect(302,u);
|
||
res.redirect('/');
|
||
});
|
||
|
||
app.get('/robots.txt', (req,res)=> res.type('text/plain').send('User-agent: *\\nDisallow:\\n'));
|
||
|
||
app.listen(PORT, ()=> console.log(`[printer-public] listening on ${PORT}`));
|
||
"""
|
||
|
||
PRINTER_PKG_PUBLIC = {
|
||
"name":"printer-public","version":"0.3.0","type":"module",
|
||
"scripts":{"start":"node server.js"},
|
||
"dependencies":{"express":"^4.19.2"}
|
||
}
|
||
|
||
# ---------------- kettle (замаскированный) ----------------
|
||
KETTLE_SERVER_PUBLIC = """import express from 'express';
|
||
import path from 'path';
|
||
import { fileURLToPath } from 'url';
|
||
|
||
// import axios from 'axios'; // <redacted>
|
||
// import crypto from 'crypto'; // <redacted>
|
||
// const PRINTER_PROOF = process.env.PRINTER_PROOF; // <redacted>
|
||
// const KETTLE_NONCE = process.env.KETTLE_NONCE; // <redacted>
|
||
// const KETTLE_SHARED_KEY = process.env.KETTLE_SHARED_KEY; // <redacted>
|
||
|
||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||
const app = express();
|
||
const PORT = process.env.PORT || 8081;
|
||
|
||
app.get('/', (req,res)=> res.redirect('/diagnostics'));
|
||
|
||
app.get('/diagnostics', (req,res)=>{
|
||
// In private build this page exposes limited device info and triggers telemetry.
|
||
res.type('text/plain').send('Kettle diagnostics (public build)');
|
||
});
|
||
|
||
app.post('/diagnostics/fetch', (req,res)=>{
|
||
// <redacted>: route-signature-based fetch via internal gateway
|
||
// key = (PRINTER_PROOF + ":" + KETTLE_NONCE).encode()
|
||
//mac = hmac.new(key, (url + '\n' + ts).encode(), hashlib.sha256).hexdigest()
|
||
res.status(501).type('text/plain').send('disabled in public build');
|
||
});
|
||
|
||
app.get('/assets/badge.svg', (req,res)=>{
|
||
res.type('image/svg+xml').send('<svg xmlns="http://www.w3.org/2000/svg" width="20" height="20"><circle cx="10" cy="10" r="7" fill="#5c7cfa"/></svg>');
|
||
});
|
||
|
||
app.listen(PORT, ()=> console.log(`[kettle-public] listening on ${PORT}`));
|
||
"""
|
||
|
||
KETTLE_PKG_PUBLIC = {
|
||
"name":"kettle-public","version":"0.3.0","type":"module",
|
||
"scripts":{"start":"node server.js"},
|
||
"dependencies":{"express":"^4.19.2"}
|
||
}
|
||
|
||
# ---------------- nas (замаскированный) ----------------
|
||
NAS_SERVER_PUBLIC = """import express from 'express';
|
||
import path from 'path';
|
||
import { fileURLToPath } from 'url';
|
||
// import jwt from 'jsonwebtoken'; // <redacted>
|
||
// import crypto from 'crypto'; // <redacted>
|
||
// const JWT_SECRET = process.env.JWT_SECRET; // <redacted>
|
||
// const KETTLE_SHARED_KEY = process.env.KETTLE_SHARED_KEY; // <redacted>
|
||
|
||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||
const app = express();
|
||
const PORT = process.env.PORT || 5000;
|
||
|
||
app.use(express.urlencoded({ extended:false }));
|
||
app.use(express.json());
|
||
|
||
app.get('/', (req,res)=> res.redirect('/login'));
|
||
app.get('/login', (req,res)=> res.type('text/plain').send('NAS login (public build)'));
|
||
app.post('/login', (req,res)=> res.status(501).send('disabled in public build'));
|
||
// admin_pass = hashlib.sha1((KETTLE_PROOF + ":" + PRINTER_PROOF).encode()).hexdigest()[:12]
|
||
|
||
app.get('/internal/hint', (req,res)=>{
|
||
// <redacted> internal gateway-only endpoint (requires shared key + route sign)
|
||
res.status(403).type('text/plain').send('forbidden (public build)');
|
||
});
|
||
|
||
app.get('/admin/flag', (req,res)=> res.status(404).send('not found'));
|
||
const auth = req.headers.authorization || '';
|
||
const token = auth.replace(/^Bearer\s+/,'');
|
||
try{
|
||
const payload = jwt.verify(token, JWT_SECRET, { algorithms:['HS256'] });
|
||
if (payload.role !== 'admin') return res.status(403).send('need admin role');
|
||
if (payload.kpf !== KETTLE_PROOF) return res.status(403).send('incorrect kpf');
|
||
if (payload.aud !== 'nas-admin') return res.status(403).send('bad aud');
|
||
const now = Math.floor(Date.now()/1000);
|
||
if (!payload.iat || Math.abs(now - payload.iat) > 120) return res.status(403).send('iat too old');
|
||
|
||
app.listen(PORT, ()=> console.log(`[nas-public] listening on ${PORT}`));
|
||
"""
|
||
|
||
NAS_PKG_PUBLIC = {
|
||
"name":"nas-public","version":"0.3.0","type":"module",
|
||
"scripts":{"start":"node server.js"},
|
||
"dependencies":{"express":"^4.19.2"}
|
||
}
|
||
|
||
def commit(root, message, when, author):
|
||
sh(["git","add","-A"], cwd=root)
|
||
env = os.environ.copy()
|
||
env.update({
|
||
"GIT_AUTHOR_NAME": author[0], "GIT_AUTHOR_EMAIL": author[1],
|
||
"GIT_COMMITTER_NAME": author[0], "GIT_COMMITTER_EMAIL": author[1],
|
||
"GIT_AUTHOR_DATE": when.isoformat(),
|
||
"GIT_COMMITTER_DATE": when.isoformat(),
|
||
})
|
||
sh(["git","commit","-m", message], cwd=root, env=env)
|
||
|
||
def set_mesh(root, value):
|
||
cfgp = os.path.join(root,"router/config/router.json")
|
||
with open(cfgp,"r+",encoding="utf-8") as f:
|
||
data = json.load(f)
|
||
data["mesh"] = value
|
||
f.seek(0); json.dump(data, f, indent=2); f.truncate()
|
||
|
||
def add_vendor_note(root, b64text):
|
||
p = os.path.join(root,"router/server.js")
|
||
with open(p,"a",encoding="utf-8") as f:
|
||
f.write(f"\n// vendor-note: {b64text}\n")
|
||
|
||
def remove_vendor_note(root):
|
||
p = os.path.join(root,"router/server.js")
|
||
with open(p,"r",encoding="utf-8") as f:
|
||
s = f.read()
|
||
s = re.sub(r"\n?//\s*vendor-note:[^\n]*\n?", "\n", s, flags=re.IGNORECASE)
|
||
with open(p,"w",encoding="utf-8") as f:
|
||
f.write(s)
|
||
|
||
def add_trailing_space_lines(path):
|
||
with open(path, "r", encoding="utf-8") as f:
|
||
lines = f.read().splitlines()
|
||
with open(path, "w", encoding="utf-8") as f:
|
||
for line in lines:
|
||
f.write(line.rstrip(" ") + " \n")
|
||
|
||
def strip_trailing_space_lines(path):
|
||
with open(path, "r", encoding="utf-8") as f:
|
||
lines = f.read().splitlines()
|
||
with open(path, "w", encoding="utf-8") as f:
|
||
for line in lines:
|
||
f.write(line.rstrip(" ") + "\n")
|
||
|
||
def snapshot_public_sources(root):
|
||
for rel in ("kettle/server.js", "nas/server.js"):
|
||
add_trailing_space_lines(os.path.join(root, rel))
|
||
|
||
def restore_public_sources(root):
|
||
for rel in ("kettle/server.js", "nas/server.js"):
|
||
strip_trailing_space_lines(os.path.join(root, rel))
|
||
|
||
def mutate_noise(root, i):
|
||
choice = random.choice(["docs","router","printer","kettle","nas"])
|
||
if choice == "docs":
|
||
p = os.path.join(root,"docs/CHANGELOG.md")
|
||
with open(p,"a",encoding="utf-8") as f:
|
||
f.write(f"- maintenance {i}\n")
|
||
elif choice in ("router","printer","kettle","nas"):
|
||
p = os.path.join(root, f"{choice}/server.js") if choice=="router" else os.path.join(root,f"{choice}/server.js")
|
||
# лёгкая косметика-комментарий
|
||
with open(p,"a",encoding="utf-8") as f:
|
||
f.write(f"\n// note: minor tweak {i}\n")
|
||
|
||
def init_repo(root, primary_author, authors):
|
||
if os.path.exists(root):
|
||
shutil.rmtree(root)
|
||
os.makedirs(root, exist_ok=True)
|
||
sh(["git","init","--initial-branch=main"], cwd=root)
|
||
|
||
write(os.path.join(root,"README.md"), BASE_README)
|
||
write(os.path.join(root,"docs/CHANGELOG.md"), "## Changelog (public)\n")
|
||
|
||
# router
|
||
write(os.path.join(root,"router/server.js"), ROUTER_SERVER)
|
||
write(os.path.join(root,"router/package.json"), json.dumps(ROUTER_PKG, indent=2, ensure_ascii=False))
|
||
write(os.path.join(root,"router/config/router.json"), json.dumps({"vendor":"Orbital Home","mesh":"OH-2194"}, indent=2))
|
||
|
||
# printer (публичный, безопасный)
|
||
write(os.path.join(root,"printer/server.js"), PRINTER_SERVER_PUBLIC)
|
||
write(os.path.join(root,"printer/package.json"), json.dumps(PRINTER_PKG_PUBLIC, indent=2, ensure_ascii=False))
|
||
write(os.path.join(root,"printer/data/queue/readme.txt"), "public job\n")
|
||
|
||
# kettle (публичный, урезанный)
|
||
write(os.path.join(root,"kettle/server.js"), KETTLE_SERVER_PUBLIC)
|
||
write(os.path.join(root,"kettle/package.json"), json.dumps(KETTLE_PKG_PUBLIC, indent=2, ensure_ascii=False))
|
||
|
||
# nas (публичный, урезанный)
|
||
write(os.path.join(root,"nas/server.js"), NAS_SERVER_PUBLIC)
|
||
write(os.path.join(root,"nas/package.json"), json.dumps(NAS_PKG_PUBLIC, indent=2, ensure_ascii=False))
|
||
|
||
commit(root, "init(public): scaffold modules", TIME_START, primary_author)
|
||
|
||
def build_main(root, authors):
|
||
t = TIME_START
|
||
for i in range(1, MAIN_COMMITS+1):
|
||
t = t + STEP_MAIN + timedelta(minutes=random.randint(0,59))
|
||
mutate_noise(root, i)
|
||
commit(root, random.choice(NOISE_MESSAGES), t, random.choice(authors))
|
||
return t
|
||
|
||
def merge_noff(root, branch_name, message, when, author):
|
||
sh(["git","checkout","main"], cwd=root)
|
||
sh(["git","merge","--no-ff", branch_name, "-m", message], cwd=root)
|
||
|
||
def build_feature_branch(root, name, commits, base_time, authors):
|
||
sh(["git","checkout","-b", name], cwd=root)
|
||
t = base_time
|
||
for i in range(commits):
|
||
t = t + STEP_BRANCH + timedelta(minutes=random.randint(0,40))
|
||
mutate_noise(root, 5000+i)
|
||
commit(root, f"{name}: routine update {i+1}", t, random.choice(authors))
|
||
merge_noff(root, name, f"merge: {name}", t + timedelta(minutes=5), random.choice(authors))
|
||
sh(["git","branch","-d", name], cwd=root)
|
||
|
||
def build_secret_branch(root, base_time, authors):
|
||
# ответвиться от текущего HEAD main
|
||
sh(["git","checkout","-b", BRANCH_SECRET], cwd=root)
|
||
t = base_time
|
||
|
||
# немного шума до секрета
|
||
for i in range(2):
|
||
t = t + STEP_BRANCH + timedelta(minutes=random.randint(0,30))
|
||
mutate_noise(root, 8000+i)
|
||
commit(root, random.choice(NOISE_MESSAGES), t, random.choice(authors))
|
||
|
||
# СЕКРЕТНЫЙ КОММИТ: OH-21B4 + base64-флаг как комментарий в router/server.js
|
||
t = t + STEP_BRANCH
|
||
set_mesh(root, "OH-21B4")
|
||
add_vendor_note(root, FLAG_B64)
|
||
snapshot_public_sources(root)
|
||
commit(root, "router: set mesh id in config (staging bench)", t, random.choice(authors))
|
||
|
||
# ещё шум
|
||
for i in range(2):
|
||
t = t + STEP_BRANCH
|
||
mutate_noise(root, 8100+i)
|
||
commit(root, random.choice(NOISE_MESSAGES), t, random.choice(authors))
|
||
|
||
# вернуть прод-значение и удалить комментарий
|
||
t = t + STEP_BRANCH
|
||
set_mesh(root, "OH-2194")
|
||
remove_vendor_note(root)
|
||
restore_public_sources(root)
|
||
commit(root, "router: revert mesh id to production", t, random.choice(authors))
|
||
|
||
# финальный шум на ветке
|
||
t = t + STEP_BRANCH
|
||
mutate_noise(root, 8200)
|
||
commit(root, "chore: staging cleanup", t, random.choice(authors))
|
||
|
||
# squash-merge в main (в main ни OH-21B4, ни vendor-note не попадут)
|
||
sh(["git","checkout","main"], cwd=root)
|
||
sh(["git","merge","--squash", BRANCH_SECRET], cwd=root)
|
||
t = t + STEP_BRANCH
|
||
commit(root, f"merge: {BRANCH_SECRET}", t, random.choice(authors))
|
||
# Ветку НЕ удаляем — пусть живёт
|
||
|
||
def tag_releases(root):
|
||
sh(["git","tag","-a","v0.2.0","-m","public release 0.2.0"], cwd=root)
|
||
sh(["git","tag","-a","v0.3.0","-m","public release 0.3.0"], cwd=root)
|
||
|
||
def main():
|
||
parser = argparse.ArgumentParser()
|
||
parser.add_argument("--author-name", default=None, help="Primary author name")
|
||
parser.add_argument("--author-email", default=None, help="Primary author email")
|
||
parser.add_argument("--push", default=None, help="Git remote URL to push (SSH or HTTPS)")
|
||
args = parser.parse_args()
|
||
|
||
primary = (args.author_name or "Your Name", args.author_email or "you@example.com")
|
||
authors = [primary] + [a for a in AUTHORS_DEFAULT if a[1] != primary[1]]
|
||
|
||
random.seed(42)
|
||
root = os.path.abspath(REPO_NAME)
|
||
init_repo(root, primary, authors)
|
||
t_end_main = build_main(root, authors)
|
||
|
||
# пара симпатичных merge-веток
|
||
for name, count in FEATURE_BRANCHES:
|
||
build_feature_branch(root, name, count, t_end_main, authors)
|
||
t_end_main = t_end_main + timedelta(hours=1)
|
||
|
||
# секретная ветка
|
||
build_secret_branch(root, t_end_main, authors)
|
||
|
||
tag_releases(root)
|
||
|
||
print(f"[ok] repo created: {root}")
|
||
print("\nПроверка локально:")
|
||
print(" cd", REPO_NAME)
|
||
print(" git log -S 'OH-21B4' --all --oneline")
|
||
print(" git grep -n 'OH-21B4' $(git rev-list --all)")
|
||
print(" git show $(git log -S 'OH-21B4' --all -n 1 --pretty=%H) | grep -i 'vendor-note'")
|
||
print("\nПуш в GitHub вручную:")
|
||
print(" git remote add origin <YOUR_GITHUB_REPO_URL>")
|
||
print(" git push -u origin --all --tags")
|
||
|
||
if args.push:
|
||
sh(["git","remote","add","origin", args.push], cwd=root)
|
||
sh(["git","push","-u","origin","--all"], cwd=root)
|
||
sh(["git","push","origin","--tags"], cwd=root)
|
||
print("[ok] pushed to:", args.push)
|
||
print("Проверь ветки/теги на GitHub UI.")
|
||
|
||
if __name__ == "__main__":
|
||
main()
|
||
|
||
|
||
|
||
|
||
|
||
|