| |
| """Verify every immutable file declared by the v1 release manifest.""" |
|
|
| from __future__ import annotations |
|
|
| import hashlib |
| import json |
| from pathlib import Path |
| import sys |
|
|
|
|
| RELEASE_ROOT = Path(__file__).resolve().parent |
| MANIFEST_PATH = RELEASE_ROOT / "MANIFEST.json" |
|
|
|
|
| def sha256(path: Path) -> str: |
| digest = hashlib.sha256() |
| with path.open("rb") as handle: |
| for chunk in iter(lambda: handle.read(1024 * 1024), b""): |
| digest.update(chunk) |
| return digest.hexdigest() |
|
|
|
|
| def main() -> int: |
| manifest = json.loads(MANIFEST_PATH.read_text(encoding="utf-8")) |
| failures: list[str] = [] |
| checked: list[dict[str, object]] = [] |
| declared_paths = { |
| Path(record["path"]).as_posix() for record in manifest["files"] |
| } |
| actual_paths = { |
| path.relative_to(RELEASE_ROOT).as_posix() |
| for path in RELEASE_ROOT.rglob("*") |
| if ( |
| path.is_file() |
| and path != MANIFEST_PATH |
| and "__pycache__" not in path.relative_to(RELEASE_ROOT).parts |
| and path.suffix != ".pyc" |
| ) |
| } |
| undeclared = sorted(actual_paths - declared_paths) |
| absent = sorted(declared_paths - actual_paths) |
| if undeclared: |
| failures.extend(f"undeclared package file: {path}" for path in undeclared) |
| if absent: |
| failures.extend(f"declared package file is absent: {path}" for path in absent) |
| for record in manifest["files"]: |
| relative = Path(record["path"]) |
| path = (RELEASE_ROOT / relative).resolve() |
| if not path.is_relative_to(RELEASE_ROOT): |
| failures.append(f"path escapes release root: {relative}") |
| continue |
| if not path.is_file(): |
| failures.append(f"missing: {relative}") |
| continue |
| if path.is_symlink(): |
| failures.append(f"release file must not be a symlink: {relative}") |
| continue |
| actual_size = path.stat().st_size |
| actual_hash = sha256(path) |
| if actual_size != record["size"]: |
| failures.append( |
| f"size mismatch {relative}: {actual_size} != {record['size']}" |
| ) |
| if actual_hash != record["sha256"]: |
| failures.append( |
| f"SHA-256 mismatch {relative}: {actual_hash} != " |
| f"{record['sha256']}" |
| ) |
| checked.append( |
| { |
| "path": str(relative), |
| "size": actual_size, |
| "sha256": actual_hash, |
| } |
| ) |
|
|
| result = { |
| "schema_version": manifest["schema_version"], |
| "status": "pass" if not failures else "fail", |
| "checked_file_count": len(checked), |
| "failures": failures, |
| } |
| print(json.dumps(result, indent=2, sort_keys=True)) |
| return 0 if not failures else 1 |
|
|
|
|
| if __name__ == "__main__": |
| raise SystemExit(main()) |
|
|
