IQ.Pilot Release Commit @ bec7652

artifacts/runtime/verify_proprietary_bundle.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+import argparse
+import hashlib
+import json
+import stat
+from pathlib import Path
+
+
+def parse_args() -> argparse.Namespace:
+  p = argparse.ArgumentParser(description="Verify IQ Pilot proprietary bundle manifest")
+  p.add_argument("bundle_root", help="Bundle directory containing manifest.json")
+  return p.parse_args()
+
+
+def sha256(path: Path) -> str:
+  h = hashlib.sha256()
+  with path.open("rb") as f:
+    while True:
+      b = f.read(1024 * 1024)
+      if not b:
+        break
+      h.update(b)
+  return h.hexdigest()
+
+
+def main() -> None:
+  args = parse_args()
+  root = Path(args.bundle_root).resolve()
+  manifest_path = root / "manifest.json"
+  if not manifest_path.exists():
+    raise SystemExit(f"manifest not found: {manifest_path}")
+
+  manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+  failures: list[str] = []
+
+  for rel, meta in manifest.items():
+    if rel in {"signatures", "runtime"}:
+      continue
+    f = root / rel
+    if not f.exists():
+      failures.append(f"missing: {rel}")
+      continue
+
+    got = sha256(f)
+    exp = str(meta["sha256"])
+    if got != exp:
+      failures.append(f"sha256 mismatch: {rel}")
+
+    got_size = f.stat().st_size
+    exp_size = int(meta["size"])
+    if got_size != exp_size:
+      failures.append(f"size mismatch: {rel} ({got_size} != {exp_size})")
+
+    if "mode" in meta:
+      got_mode = stat.S_IMODE(f.stat().st_mode)
+      exp_mode = int(meta["mode"])
+      if got_mode != exp_mode:
+        failures.append(f"mode mismatch: {rel} ({got_mode:o} != {exp_mode:o})")
+
+  if failures:
+    print("FAILED")
+    for x in failures:
+      print(x)
+    raise SystemExit(1)
+
+  print("OK")
+
+
+if __name__ == "__main__":
+  main()