| """Offline package integrity validation, without model or GPU imports.""" | |
| import argparse | |
| import hashlib | |
| import json | |
| from pathlib import Path | |
| p=argparse.ArgumentParser() | |
| p.add_argument("--package",type=Path,default=Path(__file__).resolve().parent.parent) | |
| args=p.parse_args() | |
| root=args.package.resolve() | |
| manifest=json.loads((root/"release-manifest.json").read_text()) | |
| expected={row["file"] for row in manifest["files"]} | |
| for row in manifest["files"]: | |
| path=root/row["file"] | |
| assert path.resolve().is_relative_to(root),"Path outside package" | |
| assert path.is_file() and not path.is_symlink(),path | |
| assert path.stat().st_size==row["bytes"],path | |
| assert hashlib.file_digest(path.open("rb"),"sha256").hexdigest()==row["sha256"],path | |
| actual={str(x.relative_to(root)) for x in root.rglob("*") if x.is_file() | |
| and not any(part in x.parts for part in ("__pycache__", ".git", ".cache")) and x.name!="release-manifest.json"} | |
| assert actual==expected,(sorted(actual-expected),sorted(expected-actual)) | |
| print("PASS:",len(expected),"allowlisted files; all SHA-256 hashes verified") | |