完成真实成对异机备份（07-26-internal-ops-recovery-baseline）

scripts/qa/run-backup-restore-drill.sh

@@ -24,9 +24,13 @@ require_command() {
   fi
 }
 
-for command_name in docker pg_dump pg_restore psql tar sha256sum node; do
+for command_name in docker pg_dump pg_restore psql tar sha256sum; do
   require_command "$command_name"
 done
+if ! command -v node >/dev/null 2>&1 && ! command -v python3 >/dev/null 2>&1; then
+  echo "[ERR] required command missing: node or python3" >&2
+  exit 1
+fi
 
 START_EPOCH="$(date +%s)"
 SOURCE_STORAGE="$DRILL_DIR/source-storage"
@@ -64,7 +68,8 @@ BATCH_DIR="$BACKUP_ROOT/hyb-oa-backup-$DRILL_RUN_ID"
 DB_BACKUP="$BATCH_DIR/database.dump"
 STORAGE_BACKUP="$BATCH_DIR/storage.tar.gz"
 
-node - "$BATCH_DIR/manifest.json" "$DB_BACKUP" "$STORAGE_BACKUP" <<'NODE'
+if command -v node >/dev/null 2>&1; then
+  node - "$BATCH_DIR/manifest.json" "$DB_BACKUP" "$STORAGE_BACKUP" <<'NODE'
 const crypto = require("node:crypto");
 const fs = require("node:fs");
 const path = require("node:path");
@@ -80,6 +85,39 @@ const sha256 = (file) => crypto.createHash("sha256").update(fs.readFileSync(file
 if (sha256(dbPath) !== manifest.artifacts.database.sha256) throw new Error("database checksum mismatch");
 if (sha256(storagePath) !== manifest.artifacts.storage.sha256) throw new Error("storage checksum mismatch");
 NODE
+else
+  python3 - "$BATCH_DIR/manifest.json" "$DB_BACKUP" "$STORAGE_BACKUP" <<'PYTHON'
+import hashlib
+import json
+import os
+import re
+import sys
+
+manifest_path, db_path, storage_path = sys.argv[1:]
+with open(manifest_path, encoding="utf-8") as manifest_file:
+    manifest_text = manifest_file.read()
+manifest = json.loads(manifest_text)
+if manifest.get("status") != "complete" or manifest.get("schemaVersion") != 1:
+    raise RuntimeError("manifest contract mismatch")
+for artifact in (manifest["artifacts"]["database"], manifest["artifacts"]["storage"]):
+    if os.path.isabs(artifact["file"]):
+        raise RuntimeError("manifest contains absolute artifact path")
+if re.search(r"postgresql:|DATABASE_URL|drill_password", manifest_text):
+    raise RuntimeError("manifest contains sensitive connection data")
+
+def sha256(file_path):
+    digest = hashlib.sha256()
+    with open(file_path, "rb") as artifact_file:
+        for block in iter(lambda: artifact_file.read(1024 * 1024), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+if sha256(db_path) != manifest["artifacts"]["database"]["sha256"]:
+    raise RuntimeError("database checksum mismatch")
+if sha256(storage_path) != manifest["artifacts"]["storage"]["sha256"]:
+    raise RuntimeError("storage checksum mismatch")
+PYTHON
+fi
 
 psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -qc 'DROP TABLE restore_drill_marker'