fix: close release provenance and privacy gaps

containers/privacy-worker-b/worker.py

@@ -1,20 +1,23 @@
 import hashlib
 import json
 
-with open('/input/request.json', 'r', encoding='utf-8') as handle:
-    request = json.load(handle)
-if request.get('schema') != 'portfolio-privacy-worker-request/v1' or request.get('workerId') != 'worker-b':
-    raise ValueError('Invalid worker request.')
-with open('/input/object', 'rb') as handle:
-    payload = handle.read()
-actual = hashlib.sha256(payload).hexdigest()
-if actual != request.get('inputDigest'):
-    raise ValueError('Input digest mismatch.')
-members = ['bytes:' + actual]
-normalized = json.dumps(members, separators=(',', ':')).encode('utf-8')
-output = {'schema': 'portfolio-privacy-worker-report/v1', 'workerId': 'worker-b', 'imageDigest': request['imageDigest'],
-          'toolchain': 'bytes-python/v1', 'inputDigest': actual, 'checkId': request['checkId'],
-          'normalizedOutputDigest': hashlib.sha256(normalized).hexdigest(), 'normalizedMembers': members,
-          'verdict': 'pass', 'findingsDigest': '0' * 64}
-with open('/output/report.json', 'x', encoding='utf-8') as handle:
-    json.dump(output, handle, separators=(',', ':'))
+def inspect_object(request, payload):
+    if request.get('schema') != 'portfolio-privacy-worker-request/v1' or request.get('workerId') != 'worker-b':
+        raise ValueError('Invalid worker request.')
+    actual = hashlib.sha256(payload).hexdigest()
+    if actual != request.get('inputDigest'):
+        raise ValueError('Input digest mismatch.')
+    members = ['unsupported:' + actual]
+    normalized = json.dumps(members, separators=(',', ':')).encode('utf-8')
+    return {'schema': 'portfolio-privacy-worker-report/v1', 'workerId': 'worker-b', 'imageDigest': request['imageDigest'],
+            'toolchain': 'scanner-unavailable-python/v1', 'inputDigest': actual, 'checkId': request['checkId'],
+            'normalizedOutputDigest': hashlib.sha256(normalized).hexdigest(), 'normalizedMembers': members,
+            'verdict': 'unsupported', 'findingsDigest': hashlib.sha256(b'scanner-unavailable').hexdigest()}
+
+if __name__ == '__main__':
+    with open('/input/request.json', 'r', encoding='utf-8') as handle:
+        request = json.load(handle)
+    with open('/input/object', 'rb') as handle:
+        payload = handle.read()
+    with open('/output/report.json', 'x', encoding='utf-8') as handle:
+        json.dump(inspect_object(request, payload), handle, separators=(',', ':'))