#!/usr/bin/env python3 """ IwoooS Wazuh 只讀 API release owner response acceptance 帳本。 本工具定義未來 owner response 如何被收件、補件、隔離、拒收或進入 reviewer validation；它不讀 credential、不推送、不部署、不查 Wazuh、 不寫 runtime，也不把一般批准繼續當 release 授權。 """ from __future__ import annotations import argparse import json import sys from datetime import datetime, timedelta, timezone from pathlib import Path from typing import Any TAIPEI = timezone(timedelta(hours=8)) SNAPSHOT_PATH = Path("docs/security/wazuh-readonly-release-owner-response-acceptance.snapshot.json") REQUIRED_ACK_FLAGS = [ "approve_formal_release_lane", "confirm_no_plaintext_token_workaround", "confirm_no_force_push", "confirm_no_runtime_workaround", "confirm_production_readback_after_deploy", "confirm_wazuh_live_metadata_requires_separate_owner_gate", ] REQUIRED_EVIDENCE_FIELDS = [ "release_lane_owner", "release_method", "target_branch_or_patch_set", "post_deploy_readback_command", "rollback_owner", "blocked_runtime_actions_ack", ] REVIEWER_CHECKS = [ "owner_identity_present", "release_method_allowed", "target_scope_matches_wazuh_branch_or_patch_set", "all_ack_flags_true", "all_evidence_fields_present", "redacted_refs_only", "secret_value_absent", "no_plaintext_token_workaround", "no_force_push", "no_runtime_workaround", "post_deploy_readback_required", "rollback_owner_present", "live_metadata_gate_separate", "active_response_stays_false", "counts_transition_safe", ] OUTCOME_LANES = [ "waiting_owner_response", "quarantine_secret_or_raw_payload", "reject_execution_request", "request_supplement", "ready_for_release_reviewer_validation", "formal_gitea_merge_candidate", "formal_patch_apply_candidate", "safe_credential_push_candidate", "waiting_production_readback", "waiting_runtime_gate", ] BLOCKED_ACTIONS = [ "plain_text_gitea_token_in_remote_url", "copy_token_from_dirty_workspace", "force_push", "nginx_or_gateway_workaround_for_404", "docker_restart_for_wazuh_route", "k8s_or_argocd_manual_apply_for_wazuh_route", "firewall_change_for_wazuh_route", "wazuh_secret_or_manager_change_for_api_404", "enable_wazuh_live_metadata_without_owner_gate", "enable_wazuh_active_response", "host_write_or_kali_active_scan", "mark_general_approval_as_release_response", "mark_predeploy_404_as_passed_readback", ] def now_iso() -> str: return datetime.now(TAIPEI).replace(microsecond=0).isoformat() def build_report(generated_at: str | None = None) -> dict[str, Any]: return { "schema_version": "iwooos_wazuh_readonly_release_owner_response_acceptance_v1", "generated_at": generated_at or now_iso(), "status": "waiting_owner_response", "mode": "metadata_only_acceptance_no_secret_no_runtime_no_push", "summary": { "acceptance_candidate_count": 1, "required_ack_flag_count": len(REQUIRED_ACK_FLAGS), "accepted_ack_flag_count": 0, "required_evidence_field_count": len(REQUIRED_EVIDENCE_FIELDS), "accepted_evidence_field_count": 0, "reviewer_check_count": len(REVIEWER_CHECKS), "outcome_lane_count": len(OUTCOME_LANES), "blocked_action_count": len(BLOCKED_ACTIONS), "owner_response_received_count": 0, "owner_response_accepted_count": 0, "owner_response_rejected_count": 0, "owner_response_quarantined_count": 0, "supplement_requested_count": 0, "formal_release_lane_ready_count": 0, "gitea_push_authorized_count": 0, "patch_apply_authorized_count": 0, "production_deploy_authorized_count": 0, "production_readback_passed_count": 0, "runtime_gate_count": 0, }, "acceptance_candidate": { "acceptance_candidate_id": "iwooos_wazuh_readonly_release_owner_response", "request_id": "iwooos_wazuh_readonly_release_owner_request", "status": "waiting_owner_response", "owner_role_or_team": "pending_owner_response", "decision": "pending_owner_response", "decision_reason": "pending_owner_response", "release_method": "pending_owner_response", "target_branch_or_patch_set": "pending_owner_response", "post_deploy_readback_command": "python3 scripts/security/wazuh-readonly-production-readback.py --json", "rollback_owner": "pending_owner_response", "redacted_evidence_refs": [], "ack_flags": {flag: False for flag in REQUIRED_ACK_FLAGS}, "required_ack_flags": REQUIRED_ACK_FLAGS, "required_evidence_fields": REQUIRED_EVIDENCE_FIELDS, "reviewer_checks": REVIEWER_CHECKS, "outcome_lanes": OUTCOME_LANES, "blocked_actions": BLOCKED_ACTIONS, "not_approval": True, "owner_response_received": False, "owner_response_accepted": False, "owner_response_rejected": False, "owner_response_quarantined": False, "supplement_requested": False, "formal_release_lane_ready": False, "gitea_push_authorized": False, "patch_apply_authorized": False, "production_deploy_authorized": False, "production_readback_passed": False, "runtime_gate": False, }, "execution_boundaries": { "repo_write_authorized": False, "gitea_push_authorized": False, "patch_apply_authorized": False, "production_deploy_authorized": False, "runtime_execution_authorized": False, "secret_value_collection_allowed": False, "plain_text_token_workaround_allowed": False, "force_push_allowed": False, "wazuh_api_live_query_authorized": False, "wazuh_active_response_authorized": False, "host_write_authorized": False, "kali_active_scan_authorized": False, "not_authorization": True, }, "reviewer_instructions": [ "只有具備完整欄位、脫敏 evidence refs、無 secret、無 runtime 要求的 owner response 才能進 reviewer validation。", "一般批准繼續、截圖、口頭同意或未列 release method 的訊息都不能增加 accepted count。", "即使 owner response accepted，也只代表可進正式 release lane；Wazuh live metadata 與 active response 仍是不同 gate。", "production readback 必須在部署後不加 --allow-predeploy-404 執行，且不得回 404。", ], } def validate(root: Path) -> None: snapshot_path = root / SNAPSHOT_PATH if not snapshot_path.exists(): raise SystemExit( f"BLOCKED Wazuh release owner response acceptance snapshot missing: {SNAPSHOT_PATH}" ) snapshot = json.loads(snapshot_path.read_text(encoding="utf-8")) expected = build_report(snapshot.get("generated_at")) for key in ("schema_version", "status", "mode"): if snapshot.get(key) != expected[key]: raise SystemExit(f"BLOCKED Wazuh release owner response acceptance {key} mismatch") for key, expected_value in expected["summary"].items(): actual = snapshot.get("summary", {}).get(key) if actual != expected_value: raise SystemExit( f"BLOCKED Wazuh release owner response acceptance summary.{key}: " f"expected {expected_value!r}, got {actual!r}" ) for key, value in snapshot.get("execution_boundaries", {}).items(): if key == "not_authorization": if value is not True: raise SystemExit( "BLOCKED Wazuh release owner response acceptance not_authorization must be true" ) elif value is not False: raise SystemExit( f"BLOCKED Wazuh release owner response acceptance execution_boundaries.{key}: expected false" ) def main() -> int: parser = argparse.ArgumentParser(description="IwoooS Wazuh 只讀 API release owner response acceptance") parser.add_argument("--root", default=".", help="repository root") parser.add_argument("--output", help="寫出 JSON 報告") parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用") args = parser.parse_args() root = Path(args.root).resolve() report = build_report(args.generated_at) if args.output: output = Path(args.output) output.parent.mkdir(parents=True, exist_ok=True) output.write_text(json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + "\n", encoding="utf-8") validate(root) summary = report["summary"] print( "WAZUH_READONLY_RELEASE_OWNER_RESPONSE_ACCEPTANCE_OK " f"received={summary['owner_response_received_count']} " f"accepted={summary['owner_response_accepted_count']} " f"acks={summary['accepted_ack_flag_count']}/{summary['required_ack_flag_count']} " f"evidence={summary['accepted_evidence_field_count']}/{summary['required_evidence_field_count']} " f"runtime_gate={summary['runtime_gate_count']}" ) return 0 if __name__ == "__main__": sys.exit(main())