Calculate SHA256 Hashes for Actions

This Python source code shows how to built hash values from the script code of actions, in conjunction with the name, version, description, output-type and input-parameters. This hash value can be used to compare an action in different stages, like development, integration and production. On this way it can be ensured that a change of a script can be made visible, if the hash values in the stages differ. The proof that a script has been transferred unchanged to another stage is a very important factor in security audits.

"""
Python action to calculate Secure Hash Algorithm SHA256 values for
all actions.

@name getHashesForActions
@returns {Properties}

@author Stefan Schnell <mail@stefan-schnell.de>
@license MIT
@version 0.1.0

Checked with Aria Automation 8.12.0 and 8.17.0
"""

import hashlib
import json
import ssl
import urllib.request


def getAllActions(vcoUrl, bearerToken):
    """ Get all actions.

    @param {string} vcoUrl - URL of Aria orchestrator
    @param {string} bearerToken
    @returns {dictionary}
    """

    returnValue = {}

    try:

        requestActions = urllib.request.Request(
            url = vcoUrl + "/api/actions"
        )
        requestActions.add_header(
          "Authorization", "Bearer " + bearerToken
        )
        requestActions.add_header(
          "Content-Type", "application/json"
        )

        responseActions = urllib.request.urlopen(
            requestActions,
            context = ssl._create_unverified_context()
        )

        if responseActions.getcode() == 200:
            returnValue = json.loads(responseActions.read())

    except Exception as err:
        raise Exception("An error occurred at detecting all actions") \
            from err

    return returnValue


def getActionDetails(actionHref, bearerToken):
    """ Gets the details of the given action.

    @param {string} actionHref - Horizontal reference of action
    @param {string} bearerToken
    @returns {dictionary}
    """

    returnValue = {}

    try:

        requestAction = urllib.request.Request(
            url = actionHref
        )
        requestAction.add_header(
            "Authorization", "Bearer " + bearerToken
        )
        requestAction.add_header(
            "Content-Type", "application/json"
        )

        responseAction = urllib.request.urlopen(
            requestAction,
            context = ssl._create_unverified_context()
        )

        if responseAction.getcode() == 200:
            returnValue = json.loads(responseAction.read())

    except Exception as err:
        raise Exception("An error occurred at detecting action details") \
            from err

    return returnValue


def handler(context, inputs):
    """ Aria Automation standard handler, the main function.
    """

    results = {}

    try:

        vcoUrl = context["vcoUrl"]
        bearerToken = context["getToken"]()

        actions = getAllActions(
            vcoUrl,
            bearerToken
        )
        if not actions:
            raise ValueError("No actions were detected")

        for action in actions["link"]:

            actionDetails = getActionDetails(
                action["href"],
                bearerToken
            )
            if not actionDetails:
                raise Exception("No action details were detected")

            actionName = actionDetails["name"]
            actionVersion = actionDetails["version"]
            if "description" in actionDetails:
                actionDescription = actionDetails["description"]
            else:
                actionDescription = ""
            if "output-type" in actionDetails:
                actionOutputType = actionDetails["output-type"]
            else:
                actionOutputType = ""
            if "input-parameters" in actionDetails:
                actionInputParameters = actionDetails["input-parameters"]
            else:
                actionInputParameters = ""
            if "script" in actionDetails:
                actionScript = actionDetails["script"]
            else:
                actionScript = ""

            hashData = actionName + " ~ " + \
                actionVersion + " ~ " + \
                actionDescription + " ~ " + \
                str(actionOutputType) + " ~ " + \
                str(actionInputParameters) + " ~ " + \
                actionScript

            key = actionDetails["module"] + "." + actionDetails["name"]
            value = hashlib.sha256(
                hashData.encode("utf-8")
            ).hexdigest()

            results[key] = value

        results = dict(sorted(results.items()))

        for key in results:
            print(key, results[key])

        outputs = {
            "status": "done",
            "results": results
        }

    except Exception as err:

        outputs = {
            "status": "incomplete",
            "error": repr(err),
            "results": results
        }

    return outputs

VCF Automation Blog

from Stefan Schnell

Calculate SHA256 Hashes for Actions