| """Install only the pinned uv executable from a hash-checked official PyPI wheel.""" |
| import hashlib |
| import io |
| import json |
| import urllib.request |
| import zipfile |
| from pathlib import Path |
|
|
| with urllib.request.urlopen("https://pypi.org/pypi/uv/0.12.17/json", timeout=30) as r: |
| metadata = json.load(r) |
| choices = [f for f in metadata["urls"] if f["filename"].endswith("manylinux_2_17_x86_64.manylinux2014_x86_64.whl")] |
| if len(choices) != 1: |
| raise RuntimeError("Expected one Linux x86_64 wheel") |
| item = choices[0] |
| if item["size"] > 40_000_000 or not item["url"].startswith("https://files.pythonhosted.org/"): |
| raise RuntimeError("Wheel boundary") |
| with urllib.request.urlopen(item["url"], timeout=60) as r: |
| body = r.read(40_000_001) |
| if len(body) != item["size"] or hashlib.sha256(body).hexdigest() != item["digests"]["sha256"]: |
| raise RuntimeError("Wheel digest mismatch") |
| destination = Path("/opt/chameleon-laya/bootstrap-uv") |
| destination.mkdir(exist_ok=True) |
| with zipfile.ZipFile(io.BytesIO(body)) as archive: |
| names = [name for name in archive.namelist() if name.endswith("/uv")] |
| if len(names) != 1: |
| raise RuntimeError("Executable member mismatch") |
| target = destination / "uv" |
| target.write_bytes(archive.read(names[0])) |
| target.chmod(0o750) |
| (destination / "receipt.json").write_text(json.dumps({"version": "0.12.17", "url": item["url"], "sha256": item["digests"]["sha256"]})) |
| print("Pinned uv bootstrap verified") |
|
|
