RayPals/Claro
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

package: verify lock checksums in doctor

Browse Source
This commit is contained in:
Hermes Agent
2026-09-03 10:38:24 +00:00
parent 011a60f140
commit fd28ee7ec1
6 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/validate_package_security.py
+12 -1
View File
@@ -93,10 +93,21 @@ def main():
if phrase not in lock:
fail(f"claro.lock missing {phrase!r}:\n{lock}")
(work / "claro.lock").write_text(
lock.replace("checksum:", "checksum: bad", 1),
encoding="utf-8",
)
rc, out = run([str(EXE), "package", "doctor"], work)
if rc == 0:
fail("package doctor must reject stale lockfile checksums")
if "BAD lock checksum: math-tools" not in out:
fail(f"package doctor stale-lock diagnostic was unclear:\n{out}")
(work / "claro.lock").write_text(lock, encoding="utf-8")
rc, out = run([str(EXE), "package", "doctor"], work)
if rc != 0:
fail(out)
for phrase in ["OK package manifest: math-tools", "OK package checksum: math-tools", "Package/project files look ready."]:
for phrase in ["OK package manifest: math-tools", "OK package checksum: math-tools", "OK lock checksum: math-tools", "Package/project files look ready."]:
if phrase not in out:
fail(f"package doctor output missing {phrase!r}:\n{out}")