128 lines
4.7 KiB
Go
128 lines
4.7 KiB
Go
//go:build llm_script
|
|
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
type deepseekNewsSignatureGuardConfig struct {
|
|
URL string
|
|
Fixture string
|
|
SnapshotDir string
|
|
BaselinePath string
|
|
Timeout time.Duration
|
|
AllowBootstrap bool
|
|
}
|
|
|
|
type deepseekNewsSignatureGuardResult struct {
|
|
SnapshotPath string
|
|
SignaturePath string
|
|
BaselinePath string
|
|
DriftDetected bool
|
|
BaselineInitialized bool
|
|
PreviousBaselineHash string
|
|
CurrentSignature deepseekNewsStructureSignature
|
|
}
|
|
|
|
const defaultDeepSeekNewsFetchURL = "https://api-docs.deepseek.com/news/news250120"
|
|
|
|
func runDeepSeekNewsSignatureGuard(cfg deepseekNewsSignatureGuardConfig, now time.Time) (deepseekNewsSignatureGuardResult, error) {
|
|
snapshotDir := cfg.SnapshotDir
|
|
if snapshotDir == "" {
|
|
snapshotDir = filepath.Join("logs", "deepseek-news-snapshots")
|
|
}
|
|
if err := os.MkdirAll(snapshotDir, 0o755); err != nil {
|
|
return deepseekNewsSignatureGuardResult{}, fmt.Errorf("mkdir snapshot dir: %w", err)
|
|
}
|
|
snapshotPath, signaturePath := resolveDeepSeekNewsSnapshotPaths("", "", snapshotDir, now)
|
|
baselinePath := cfg.BaselinePath
|
|
if baselinePath == "" {
|
|
baselinePath = filepath.Join(snapshotDir, "baseline.signature.json")
|
|
}
|
|
client := &http.Client{Timeout: cfg.Timeout}
|
|
raw, err := fetchSubscriptionPage(cfg.URL, cfg.Fixture, client)
|
|
if err != nil {
|
|
return deepseekNewsSignatureGuardResult{}, err
|
|
}
|
|
current, err := writeDeepSeekNewsSnapshotArtifacts(raw, cfg.URL, snapshotPath, signaturePath, now)
|
|
if err != nil {
|
|
return deepseekNewsSignatureGuardResult{}, err
|
|
}
|
|
result := deepseekNewsSignatureGuardResult{
|
|
SnapshotPath: snapshotPath,
|
|
SignaturePath: signaturePath,
|
|
BaselinePath: baselinePath,
|
|
CurrentSignature: current,
|
|
}
|
|
previous, err := readDeepSeekNewsStructureSignature(baselinePath)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
if !cfg.AllowBootstrap {
|
|
return result, fmt.Errorf("deepseek news baseline missing: %s", baselinePath)
|
|
}
|
|
if err := copyFileCommon(signaturePath, baselinePath); err != nil {
|
|
return result, fmt.Errorf("initialize baseline: %w", err)
|
|
}
|
|
result.BaselineInitialized = true
|
|
return result, nil
|
|
}
|
|
return result, err
|
|
}
|
|
result.PreviousBaselineHash = previous.StructureSHA256
|
|
if previous.StructureSHA256 != current.StructureSHA256 {
|
|
result.DriftDetected = true
|
|
return result, fmt.Errorf(
|
|
"deepseek news structure drift detected: baseline=%s current=%s baseline_path=%s signature_path=%s snapshot_path=%s",
|
|
previous.StructureSHA256, current.StructureSHA256, baselinePath, signaturePath, snapshotPath,
|
|
)
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
func formatDeepSeekNewsSignatureGuardSummary(result deepseekNewsSignatureGuardResult) string {
|
|
return fmt.Sprintf(
|
|
"source=deepseek-news-signature-guard drift=%t baseline_initialized=%t structure_sha256=%s previous_baseline_sha256=%s snapshot_out=%s signature_out=%s baseline_path=%s",
|
|
result.DriftDetected,
|
|
result.BaselineInitialized,
|
|
result.CurrentSignature.StructureSHA256,
|
|
emptyIfBlank(result.PreviousBaselineHash),
|
|
result.SnapshotPath,
|
|
result.SignaturePath,
|
|
result.BaselinePath,
|
|
)
|
|
}
|
|
|
|
func buildDeepSeekNewsSignatureAuditRecord(cfg deepseekNewsSignatureGuardConfig, result deepseekNewsSignatureGuardResult, checkedAt time.Time, runErr error) officialImportSignatureAuditRecord {
|
|
record := officialImportSignatureAuditRecord{
|
|
SourceKey: "deepseek_news_signature",
|
|
CheckedAt: checkedAt,
|
|
Status: officialImportSignatureAuditStatus(result.DriftDetected, result.BaselineInitialized, runErr),
|
|
DriftDetected: result.DriftDetected,
|
|
BaselineInitialized: result.BaselineInitialized,
|
|
SourceURL: strings.TrimSpace(cfg.URL),
|
|
FixturePath: strings.TrimSpace(cfg.Fixture),
|
|
SnapshotPath: strings.TrimSpace(result.SnapshotPath),
|
|
SignaturePath: strings.TrimSpace(result.SignaturePath),
|
|
BaselinePath: strings.TrimSpace(result.BaselinePath),
|
|
StructureSHA256: strings.TrimSpace(result.CurrentSignature.StructureSHA256),
|
|
PreviousStructureSHA256: strings.TrimSpace(result.PreviousBaselineHash),
|
|
ByteSize: result.CurrentSignature.ByteSize,
|
|
ErrorMessage: errorMessageText(runErr),
|
|
}
|
|
if hasDeepSeekNewsStructureSignature(result.CurrentSignature) {
|
|
signatureCopy := result.CurrentSignature
|
|
record.SignaturePayload = &signatureCopy
|
|
}
|
|
return record
|
|
}
|
|
|
|
func persistDeepSeekNewsSignatureAuditIfConfigured(cfg deepseekNewsSignatureGuardConfig, result deepseekNewsSignatureGuardResult, checkedAt time.Time, runErr error) error {
|
|
return persistOfficialImportSignatureAuditIfConfigured(buildDeepSeekNewsSignatureAuditRecord(cfg, result, checkedAt, runErr))
|
|
}
|