scripts/verify_release.py

from pathlib import Path
from hashlib import sha256
import argparse
import json


def verify(root):
    root = Path(root).resolve()
    manifest = json.loads((root / "reports/release-manifest.json").read_text(encoding="utf-8"))
    for entry in manifest["files"]:
        path = (root / entry["path"]).resolve()
        if not path.is_relative_to(root) or not path.is_file():
            raise ValueError("Missing file or invalid path: " + entry["path"])
        if path.stat().st_size != entry["bytes"] or sha256(path.read_bytes()).hexdigest() != entry["sha256"]:
            raise ValueError("Hash mismatch: " + entry["path"])
    return {"verified_files": len(manifest["files"]), "source_commit": manifest["source_commit"]}


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("root")
    print(json.dumps(verify(parser.parse_args().root)))