validate_release.py

"""Check downloaded bundle files against the published SHA256 manifest."""
from hashlib import sha256
import json
from pathlib import Path
import sys


root = Path(__file__).resolve().parent
manifest = json.loads((root / "MANIFEST.json").read_text())
errors = []
for name, expected in manifest["files"].items():
    path = root / name
    if not path.is_file():
        errors.append(f"missing: {name}")
        continue
    if path.stat().st_size != expected["bytes"]:
        errors.append(f"size mismatch: {name}")
        continue
    digest = sha256()
    with path.open("rb") as stream:
        for chunk in iter(lambda: stream.read(4 * 1024 * 1024), b""):
            digest.update(chunk)
    if digest.hexdigest() != expected["sha256"]:
        errors.append(f"SHA256 mismatch: {name}")

if errors:
    print("\n".join(errors), file=sys.stderr)
    raise SystemExit(1)
print(f"Verified {len(manifest['files'])} bundle files")