2026 全球选举季：信息可信、网络防御与 AI 透明性的工程实践

#!/usr/bash
# check-election-site.sh — 检查选举信息站点的可信信号
# 使用前：替换 DOMAIN 为你的实际域名

DOMAIN="election.example.gov"

echo "=== DNSSEC 状态 ==="
dig +dnssec $DOMAIN DNS | grep -E "flags:|RRSIG"

echo "=== HTTPS 与证书透明度 ==="
curl -sI "https://$DOMAIN" | grep -i "strict-transport"
echo "CT 日志条目数:"
curl -s "https://crt.sh/?q=$DOMAIN&output=json" | python3 -c "
import json,sys
data=json.load(sys.stdin)
print(f'共 {len(data)} 条 CT 记录')
latest=data[0] if data else {}
print(f'最近签发: {latest.get(\"not_before\",\"N/A\")} — {latest.get(\"not_after\",\"N/A\")}')
"

echo "=== 安全头部检查 ==="
curl -sI "https://$DOMAIN" | grep -iE "x-content-type|x-frame|content-security|referrer-policy"

# docker-compose.yaml — 选举基础设施监控基线
# 包含：流量异常检测、日志聚合、告警推送

services:
  prometheus:
    image: prom/prometheus:v2.53.0
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prom_data:/prometheus
    ports:
      - "9090:9090"

  alertmanager:
    image: prom/alertmanager:v0.27.0
    volumes:
      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml
    ports:
      - "9093:9093"

  loki:
    image: grafana/loki:v2.9.0
    ports:
      - "3100:3100"

  grafana:
    image: grafana/grafana:10.4.0
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=changeme_now
    ports:
      - "3000:3000"
    depends_on:
      - prometheus
      - loki

  # 模拟被监控的选举结果发布站
  web-monitor:
    image: prom/blackbox-exporter:v0.24.0
    volumes:
      - ./blackbox.yml:/etc/blackbox_exporter/config.yml
    ports:
      - "9115:9115"

volumes:
  prom_data:

# prometheus.yml — 关键告警规则片段
global:
  scrape_interval: 15s

rule_files:
  - "election_alerts.yml"

scrape_configs:
  - job_name: 'blackbox_http'
    metrics_path: /probe
    params:
      module: [http_2xx]
    static_configs:
      - targets:
          - https://results.election.example.gov
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: web-monitor:9115

# election_alerts.yml
groups:
  - name: election_infra
    rules:
      - alert: ElectionSiteDown
        expr: probe_success == 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "选举结果站点不可达"

      - alert: ElectionSiteSSLExpiring
        expr: probe_ssl_last_cert_expiry_timestamp_seconds - time() < 86400 * 14
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "选举站点证书将在两周内过期"

      - alert: ElectionResponseTimeDegraded
        expr: probe_http_duration_seconds > 5
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "选举站点响应时间超过 5 秒，可能遭受 DDoS"

"""
add_c2pa_provenance.py — 为图像添加 C2PA 来源声明
依赖安装：
  pip install c2pa-python pillow

使用前：
  1. 替换 IMAGE_PATH 为你的图片路径
  2. 替换 OUTPUT_PATH 为输出路径
  3. 确保你有一个有效的 C2PA 签名证书（测试可用 c2pa-python 内置的测试证书）
"""

from c2pa_python import C2paSigner, C2paManifestBuilder, sign_image
from PIL import Image
import json

IMAGE_PATH = "election_chart.png"
OUTPUT_PATH = "election_chart_signed.png"

# 构建声明：标注这是 AI 辅助生成的选举数据可视化
manifest = (
    C2paManifestBuilder()
    .add_claim("org.example", "election_data_viz", {
        "assertions": [
            {
                "label": "c2pa.ai.generated",
                "data": {
                    "generator": "stable-diffusion-xl",
                    "prompt": "bar chart of regional voter turnout 2026",
                    "human_reviewed": True,
                    "reviewer": "editor@example.org"
                }
            },
            {
                "label": "c2pa.actions.edit",
                "data": {
                    "action": "color_correction",
                    "software": "Photoshop 25.3",
                    "instance_id": "edit-001"
                }
            }
        ],
        "title": "2026 Regional Voter Turnout — AI-assisted visualization",
        "format": "image/png"
    })
)

# 使用测试签名证书（生产环境必须替换为正式证书）
signer = C2paSigner.from_test_cert()

# 签名并输出
sign_image(IMAGE_PATH, OUTPUT_PATH, manifest, signer)

# 验证：读取签名后的文件，确认 provenance 链完整
from c2pa_python import read_manifest
result = read_manifest(OUTPUT_PATH)
print("Provenance 验证结果:")
print(json.dumps(result, indent=2, ensure_ascii=False))