Google Play 轨道回执怎样绑定 APK 候选身份

from pathlib import Path
import json
import re
import sys

if len(sys.argv) != 4:
    raise SystemExit(2)
paths = [Path(value) for value in sys.argv[1:]]
if any(not path.is_file() for path in paths):
    raise SystemExit(2)
try:
    candidate, track, provenance = [json.loads(path.read_text(encoding="utf-8")) for path in paths]
except (OSError, UnicodeError, json.JSONDecodeError):
    raise SystemExit(2)
required = ("packageName", "versionCode", "artifactSha256", "signingCertSha256", "expectedTrack", "expectedStatus", "expectedBuilder")
if any(key not in candidate for key in required):
    raise SystemExit(2)
if not isinstance(candidate["versionCode"], int) or candidate["versionCode"] <= 0:
    raise SystemExit(2)
sha_pattern = re.compile(r"^[a-f0-9]{64}$")
if not sha_pattern.fullmatch(candidate["artifactSha256"]) or not sha_pattern.fullmatch(candidate["signingCertSha256"]):
    raise SystemExit(2)
if track.get("packageName") != candidate["packageName"] or track.get("track") != candidate["expectedTrack"]:
    raise SystemExit(3)
releases = track.get("releases")
if not isinstance(releases, list):
    raise SystemExit(2)
target = str(candidate["versionCode"])
matches = []
for release in releases:
    version_codes = release.get("versionCodes", [])
    if not isinstance(version_codes, list) or any(not isinstance(value, str) for value in version_codes):
        raise SystemExit(2)
    if target in version_codes:
        matches.append(release)
if len(matches) != 1:
    raise SystemExit(3)
release = matches[0]
if release.get("status") != candidate["expectedStatus"]:
    raise SystemExit(3)
subjects = provenance.get("subject")
if not isinstance(subjects, list):
    raise SystemExit(2)
subject_matches = [item for item in subjects if item.get("digest", {}).get("sha256") == candidate["artifactSha256"]]
if len(subject_matches) != 1:
    raise SystemExit(3)
predicate = provenance.get("predicate", {})
builder_id = predicate.get("runDetails", {}).get("builder", {}).get("id")
if builder_id != candidate["expectedBuilder"]:
    raise SystemExit(3)
report = {
    "packageName": candidate["packageName"],
    "track": track["track"],
    "versionCode": candidate["versionCode"],
    "status": release["status"],
    "userFraction": release.get("userFraction"),
    "artifactSha256": candidate["artifactSha256"],
    "signingCertSha256": candidate["signingCertSha256"],
    "provenanceSubjectMatched": True,
    "builderMatched": True,
    "distributionConfirmed": False
}
print(json.dumps(report, ensure_ascii=False, indent=2))