Initial curated projectbrain source from 8a7b1e0651dbdab97d744cbd2e653ab3970ac6c5

scripts/legacy-deployment-migration/storage.py

@@ -0,0 +1,96 @@
+"""Private durable journal and fail-closed cold-copy verification primitives."""
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import stat
+import tempfile
+
+
+def digest(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def private_write(path, data):
+    """Unique temporary files let explicit recovery proceed after process crashes."""
+    path = Path(path)
+    if path.is_symlink():
+        raise ValueError("Refusing a symlink journal/configuration target")
+    descriptor, temporary = tempfile.mkstemp(prefix=f".{path.name}-", dir=path.parent)
+    with os.fdopen(descriptor, "wb") as stream:
+        stream.write(data)
+        stream.flush()
+        os.fsync(stream.fileno())
+    os.replace(temporary, path)
+    descriptor = os.open(path.parent, os.O_RDONLY)
+    try:
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+
+
+def private_json(path, value):
+    private_write(path, json.dumps(value, sort_keys=True).encode())
+
+
+def dotenv(entries):
+    """Do not guess escaping for unsupported environment values; never log them."""
+    import re
+    result = {}
+    for entry in entries:
+        key, separator, value = entry.partition("=")
+        if not separator or not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", key):
+            raise ValueError("Unsupported runtime environment entry")
+        if key in result or any(character in value for character in "\x00\n\r'\\"):
+            raise ValueError("Runtime environment needs reviewed dotenv escaping")
+        result[key] = value
+    return "".join(f"{key}='{value}'\n" for key, value in sorted(result.items())).encode()
+
+
+def tree_manifest(root):
+    """Hash content plus ownership/modes/xattrs; reject symlinks and special files.
+
+    Preserving an unknown symlink could let the candidate write original data.
+    Hardlink equivalence groups are compared without depending on inode numbers.
+    """
+    root = Path(root)
+    if root.is_symlink() or not root.is_dir():
+        raise ValueError("Cold-copy root must be a real directory")
+    records = {}
+    inodes = {}
+    for path in [root, *sorted(root.rglob("*"))]:
+        info = path.lstat()
+        relative = str(path.relative_to(root))
+        if not stat.S_ISREG(info.st_mode) and not stat.S_ISDIR(info.st_mode):
+            raise ValueError("Cold-copy tree contains an unreviewed symlink/special file")
+        record = {"mode": stat.S_IMODE(info.st_mode), "uid": info.st_uid, "gid": info.st_gid}
+        if stat.S_ISREG(info.st_mode):
+            hasher = hashlib.sha256()
+            with path.open("rb") as stream:
+                for block in iter(lambda: stream.read(1024 * 1024), b""):
+                    hasher.update(block)
+            record.update(kind="file", size=info.st_size, sha256=hasher.hexdigest())
+            group = (info.st_dev, info.st_ino)
+            record["hardlink"] = inodes.setdefault(group, relative)
+        else:
+            record["kind"] = "directory"
+        if hasattr(os, "listxattr"):
+            record["xattrs"] = {name: digest(os.getxattr(path, name)) for name in sorted(os.listxattr(path))}
+        records[relative] = record
+    return records
+
+
+def clone_cold(source, target, runner):
+    source, target = Path(source), Path(target)
+    if target.exists() or target.is_symlink():
+        raise ValueError("Cold-copy target already exists")
+    before = tree_manifest(source)
+    target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    # Destination does not exist: cp -a copies root metadata as well as children.
+    runner(["cp", "-a", "--reflink=auto", "--", str(source), str(target)], timeout=3600)
+    runner(["sync", "-f", "--", str(target)], timeout=3600)
+    copied = tree_manifest(target)
+    if before != copied or before != tree_manifest(source):
+        raise ValueError("Cold copy content/metadata does not match unchanged original")
+    return digest(json.dumps(before, sort_keys=True).encode())