deploy: normalize release metadata and check route metadata only

deploy/query-summary/prepare-release.py

@@ -0,0 +1,59 @@
+"""为现有summary8离线tar生成LF发布元数据；不构建镜像或连接NAS。"""
+import hashlib
+import json
+import re
+import tarfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+RELEASE = ROOT / 'artifacts/query-summary/release'
+TAG = 'local/mi-fitness-nas:20261017-summary8'
+BASE_IMAGE_ID = 'sha256:f4cbe187a98e3d3223e28e79b6edd115446ba62a78931f54f3bb0a6991a9395d'
+# 部署前只读快照；实际更新脚本仍会再次比对，漂移则停止。
+EXPECTED_CURRENT = '3cdbdc882b169f5785d6d1c3c46ceb159e209c567d6e28ceb31b15d4280fcdd8'
+
+
+def sha256(path):
+    digest = hashlib.sha256()
+    with path.open('rb') as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b''):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def write_lf(name, value):
+    assert '\r' not in value and not value.startswith('\ufeff')
+    (RELEASE / name).write_bytes((value.rstrip('\n') + '\n').encode('utf-8'))
+
+
+def main():
+    tar = RELEASE / 'health-summary8.tar'
+    # 仅读取索引/配置元数据，不展开镜像层，也不修改tar。
+    with tarfile.open(tar) as archive:
+        manifest = json.load(archive.extractfile('manifest.json'))
+        assert len(manifest) == 1 and manifest[0]['RepoTags'] == [TAG]
+        index = json.load(archive.extractfile('index.json'))
+        assert len(index['manifests']) == 1
+        image_id = index['manifests'][0]['digest']
+        assert re.fullmatch(r'sha256:[0-9a-f]{64}', image_id)
+        index_blob = archive.extractfile('blobs/sha256/' + image_id.split(':')[1]).read()
+        assert hashlib.sha256(index_blob).hexdigest() == image_id.split(':')[1]
+        config = archive.extractfile(manifest[0]['Config']).read()
+        config_id = 'sha256:' + hashlib.sha256(config).hexdigest()
+        assert manifest[0]['Config'] == 'blobs/sha256/' + config_id.split(':')[1]
+    for name in ['compose.override.yml', 'update-health.sh', 'check-ready.py', 'Update-Nas.ps1']:
+        content = (Path(__file__).resolve().parent / name).read_bytes()
+        assert b'\r' not in content and not content.startswith(b'\xef\xbb\xbf'), name
+        (RELEASE / name).write_bytes(content)
+    for name, value in [('image-id.txt', image_id), ('image-config-id.txt', config_id),
+            ('base-image-id.txt', BASE_IMAGE_ID), ('expected-current.sha256', EXPECTED_CURRENT)]:
+        write_lf(name, value)
+    files = sorted(path for path in RELEASE.iterdir() if path.is_file() and path.name != 'manifest.sha256')
+    assert len(files) == 9, '发布目录包含非预期文件，停止生成清单'
+    write_lf('manifest.sha256', ''.join(sha256(path) + '  ' + path.name + '\n' for path in files))
+    print(json.dumps(dict(image_id=image_id, config_id=config_id, tar_sha256=sha256(tar),
+        manifest_sha256=sha256(RELEASE / 'manifest.sha256')), ensure_ascii=False))
+
+
+if __name__ == '__main__':
+    main()