verify_files.py

"""Verify release-manifest.json against all advertised payload bytes."""
import hashlib,json
from pathlib import Path
root=Path(__file__).resolve().parent
manifest=json.loads((root/'release-manifest.json').read_text())
for item in manifest['files']:
 p=root/item['path']
 if not p.resolve().is_relative_to(root.resolve()) or p.is_symlink():raise ValueError('Unsafe release path')
 with p.open('rb') as f:h=hashlib.file_digest(f,'sha256').hexdigest()
 if p.stat().st_size!=item['bytes'] or h!=item['sha256']:raise ValueError('File differs: '+item['path'])
print(json.dumps(dict(verified=True,files=len(manifest['files']),bytes=sum(x['bytes'] for x in manifest['files']))))