最终 APK 权限变化的发布前差分门禁怎么做

from pathlib import Path
import json
import subprocess
import sys
import xml.etree.ElementTree as ET

if len(sys.argv) != 4:
    raise SystemExit(2)
baseline_path = Path(sys.argv[1])
candidate_path = Path(sys.argv[2])
approval_path = Path(sys.argv[3])
if not baseline_path.is_file() or not candidate_path.is_file() or not approval_path.is_file():
    raise SystemExit(2)
try:
    approval = json.loads(approval_path.read_text(encoding="utf-8"))
except (OSError, UnicodeError, json.JSONDecodeError):
    raise SystemExit(2)
if not isinstance(approval.get("allowedPermissions"), list) or not isinstance(approval.get("allowedComponents"), list):
    raise SystemExit(2)
android = "{http://schemas.android.com/apk/res/android}"
component_tags = ("activity", "activity-alias", "service", "receiver", "provider")

def run_analyzer(arguments):
    completed = subprocess.run(["apkanalyzer", *arguments], text=True, capture_output=True, timeout=45)
    if completed.returncode != 0 or not completed.stdout.strip():
        raise RuntimeError("apkanalyzer failed")
    return completed.stdout

def full_name(package_name, value):
    if value.startswith("."):
        return package_name + value
    if "." not in value:
        return package_name + "." + value
    return value

def inspect(apk_path):
    permission_text = run_analyzer(["manifest", "permissions", str(apk_path)])
    manifest_text = run_analyzer(["manifest", "print", str(apk_path)])
    root = ET.fromstring(manifest_text)
    package_name = root.attrib.get("package", "")
    if not package_name:
        raise ValueError("missing package")
    permissions = sorted({line.strip() for line in permission_text.splitlines() if line.strip()})
    application = root.find("application")
    if application is None:
        raise ValueError("missing application")
    components = []
    for tag in component_tags:
        for node in application.findall(tag):
            raw_name = node.attrib.get(android + "name", "")
            if not raw_name:
                raise ValueError("component without name")
            exported = node.attrib.get(android + "exported", "unset").lower()
            permission = node.attrib.get(android + "permission", "")
            has_filter = node.find("intent-filter") is not None
            record = {"type": tag, "name": full_name(package_name, raw_name), "exported": exported, "permission": permission, "hasIntentFilter": has_filter}
            components.append(record)
    return {"package": package_name, "permissions": permissions, "components": components}

try:
    baseline = inspect(baseline_path)
    candidate = inspect(candidate_path)
except (OSError, subprocess.SubprocessError, RuntimeError, ValueError, ET.ParseError):
    raise SystemExit(2)
if baseline["package"] != candidate["package"]:
    raise SystemExit(2)
baseline_permissions = set(baseline["permissions"])
candidate_permissions = set(candidate["permissions"])
baseline_components = {json.dumps(item, ensure_ascii=False, sort_keys=True) for item in baseline["components"]}
candidate_components = {json.dumps(item, ensure_ascii=False, sort_keys=True) for item in candidate["components"]}
added_permissions = sorted(candidate_permissions - baseline_permissions)
removed_permissions = sorted(baseline_permissions - candidate_permissions)
added_components = sorted(candidate_components - baseline_components)
allowed_permissions = set(approval["allowedPermissions"])
allowed_components = {json.dumps(item, ensure_ascii=False, sort_keys=True) for item in approval["allowedComponents"]}
unapproved_permissions = sorted(set(added_permissions) - allowed_permissions)
unapproved_components = sorted(set(added_components) - allowed_components)
unset_components = sorted(item for item in candidate_components if json.loads(item)["exported"] == "unset")
report = {"addedPermissions": added_permissions, "removedPermissions": removed_permissions, "addedComponents": [json.loads(item) for item in added_components], "unapprovedPermissions": unapproved_permissions, "unapprovedComponents": [json.loads(item) for item in unapproved_components], "unsetExportedComponents": [json.loads(item) for item in unset_components]}
print(json.dumps(report, ensure_ascii=False, indent=2))
if unapproved_permissions or unapproved_components or unset_components:
    raise SystemExit(3)