jason.woltje
068d868a99
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
34 lines
2.2 KiB
Python
34 lines
2.2 KiB
Python
from pathlib import Path
|
|
import subprocess, hashlib, tempfile, os, json
|
|
out=Path(__file__).resolve().parent
|
|
root=Path('/mnt/storage/src/mosaic-stack-rocko-178')
|
|
paths=subprocess.check_output(['git','diff','--cached','--name-only'],cwd=root,text=True).splitlines()
|
|
assert len(paths)==11,paths
|
|
assert not subprocess.check_output(['git','diff','--name-only'],cwd=root), 'unstaged source changes'
|
|
subprocess.run(['git','diff','--cached','--check'],cwd=root,check=True)
|
|
(out/'base.txt').write_text(subprocess.check_output(['git','rev-parse','HEAD'],cwd=root,text=True))
|
|
(out/'changed-paths.txt').write_text('\n'.join(paths)+'\n')
|
|
(out/'build.patch').write_bytes(subprocess.check_output(['git','diff','--cached','--binary'],cwd=root))
|
|
manifest=''
|
|
for p in paths:
|
|
raw=(root/p).read_bytes()
|
|
assert raw==subprocess.check_output(['git','show',':'+p],cwd=root),p
|
|
manifest+=hashlib.sha256(raw).hexdigest()+' '+p+'\n'
|
|
(out/'candidate-manifest.sha256').write_text(manifest)
|
|
(out/'candidate.txt').write_text(hashlib.sha256(manifest.encode()).hexdigest()+'\n')
|
|
fd,idx=tempfile.mkstemp(prefix='verify-index-',dir='/mnt/storage/scratch/rocko-178');os.close(fd);os.unlink(idx)
|
|
env={**os.environ,'GIT_INDEX_FILE':idx}
|
|
try:
|
|
subprocess.run(['git','read-tree',(out/'base.txt').read_text().strip()],cwd=root,env=env,check=True)
|
|
subprocess.run(['git','apply','--cached',str(out/'build.patch')],cwd=root,env=env,check=True)
|
|
for p in paths:
|
|
assert subprocess.check_output(['git','show',':'+p],cwd=root,env=env)==(root/p).read_bytes(),p
|
|
finally:Path(idx).unlink(missing_ok=True)
|
|
pins=[]
|
|
for p in ['packages/bus/src/human.mjs','packages/bus/src/human-cli.mjs','packages/cli/src/transport.mjs','packages/webui/src/bus.mjs','packages/bus/tests/channel-proof.test.mjs']:
|
|
raw=(root/p).read_bytes();assert raw==subprocess.check_output(['git','show','HEAD:'+p],cwd=root)
|
|
pins.append({'path':p,'sha256':hashlib.sha256(raw).hexdigest(),'unchanged':True})
|
|
(out/'pins.json').write_text(json.dumps(pins,indent=2)+'\n')
|
|
(out/'verification.json').write_text(json.dumps({'staged_worktree_reconstructed_paths':len(paths),'pins_unchanged':len(pins),'source_commits':0},indent=2)+'\n')
|
|
print('VERIFIED',len(paths),'paths; candidate',hashlib.sha256(manifest.encode()).hexdigest())
|