Something went wrong. Try again.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111import argparseimport hashlibimport jsonimport osfrom pathlib import Pathimport statimport subprocessimport tempfile
VERSION = "0.17.0"SOURCE_SHA = "f56d7780b9708c417ff5093778358afa92e44106d051c94a30a18808ad2d9a84"PATCHED_SHA = "7f8dc815326f4ebf42648060484642a17217f03097f30a0fb42e93ffeb0e3a30"HELPER_SHA = "ded9677e7abe503f10562d87e4a47eb7d5246aea829027739d0d30a1c6aab447"ANCHOR = b" cb.bytes.shrinkAndFree(gpa, cb.bytes.items.len);"INSERT = b' @import("emudhra.zig").distrust(cb);\n'
def digest(data): return hashlib.sha256(data).hexdigest()
def atomic_write(path, data, mode): temporary = None try: with tempfile.NamedTemporaryFile(dir=path.parent, prefix=".emudhra-", delete=False) as file: temporary = Path(file.name) file.write(data) file.flush() os.fsync(file.fileno()) os.fchmod(file.fileno(), mode) os.replace(temporary, path) finally: if temporary is not None: temporary.unlink(missing_ok=True)
def patch(lib_dir, version, *, apply=False, restore=False): if version != VERSION: raise ValueError(f"requires Zig {VERSION}; found {version}") source = Path(lib_dir) / "std/crypto/Certificate/Bundle/macos.zig" backup = source.with_name("macos.zig.before-emudhra-2026-10-21") helper = source.with_name("emudhra.zig") for path in (source, backup, helper): if path.is_symlink(): raise ValueError(f"refusing symlink: {path}") data = source.read_bytes() current_sha = digest(data) if current_sha not in (SOURCE_SHA, PATCHED_SHA): raise ValueError(f"unknown source checksum: {current_sha}") helper_data = Path(__file__).with_name("macos_trust_filter.zig").read_bytes() if digest(helper_data) != HELPER_SHA: raise ValueError("packaged helper checksum does not match the reviewed filter") if helper.exists() and helper.read_bytes() != helper_data: raise ValueError("existing emudhra.zig differs from the reviewed filter") if backup.exists() and digest(backup.read_bytes()) != SOURCE_SHA: raise ValueError("backup checksum does not match the original source") if current_sha == PATCHED_SHA and (not backup.exists() or not helper.exists()): raise ValueError("patched source is missing its backup or helper") original = data if current_sha == SOURCE_SHA else backup.read_bytes() patched = original.replace(ANCHOR, INSERT + ANCHOR) if original.count(ANCHOR) != 1 or digest(patched) != PATCHED_SHA: raise ValueError("source hook does not produce the reviewed patch") desired = original if restore else patched changed = data != desired or (restore and helper.exists()) if apply and changed: mode = stat.S_IMODE(source.stat().st_mode) if not restore: if not backup.exists(): with backup.open("xb") as file: file.write(original) file.flush() os.fsync(file.fileno()) os.fchmod(file.fileno(), mode) if not helper.exists(): atomic_write(helper, helper_data, 0o644) if source.read_bytes() != data: raise ValueError("source changed during patch preparation") atomic_write(source, desired, mode) if restore: helper.unlink(missing_ok=True) return { "action": "restore" if restore else "patch", "mode": "apply" if apply else "dry-run", "changed": changed, "version": version, "source": str(source), "backup": str(backup), "before_sha256": current_sha, "after_sha256": digest(desired), "helper_sha256": HELPER_SHA, }
def main(): parser = argparse.ArgumentParser() parser.add_argument("--lib-dir", type=Path, required=True) parser.add_argument("--zig", default="zig") parser.add_argument("--apply", action="store_true") parser.add_argument("--restore", action="store_true") args = parser.parse_args() version = subprocess.check_output([args.zig, "version"], text=True).strip() try: result = patch(args.lib_dir, version, apply=args.apply, restore=args.restore) except (ValueError, OSError) as error: parser.error(str(error)) print(json.dumps(result, indent=2))
if __name__ == "__main__": main()