docs: retain reproducible downloaded package inspection
This commit is contained in:
@@ -0,0 +1,4 @@
|
||||
inspect_studio_package.py -text
|
||||
inspection.json -text
|
||||
download.json -text
|
||||
documents.json -text
|
||||
@@ -0,0 +1,19 @@
|
||||
# Downloaded package inspection
|
||||
|
||||
These files preserve the parent download/content check described in the
|
||||
[scope and result report](../../reviews/prerelease37-downloaded-package-20260924.md).
|
||||
`inspection.json` is the successful inspector's raw output; `download.json`
|
||||
identifies release7/asset25; `documents.json` holds the previously reviewed
|
||||
66 source-file hashes. The script performs read-only ZIP/hash checks and does
|
||||
not execute the product. It uses the binary pins from the separately reviewed
|
||||
build evidence. Its SHA-256 is
|
||||
`35f15e753c41146eb467e60f83f5b727811a12516126b448b83edd2a4fadd32c`.
|
||||
|
||||
From this directory, with Python assertions enabled:
|
||||
|
||||
```text
|
||||
python -I -B inspect_studio_package.py PATH_TO_DOWNLOADED_ZIP --archive-sha256 5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d --source 715036e132677dd2bc2fb37ed316d93dc9987aec --version 0.2.0-preview.integrated.20260924 --desktop-sha256 2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399 --server-sha256 6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237 --runtime-sha256 aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a --documents-receipt documents.json
|
||||
```
|
||||
|
||||
Gitea draft access requires an authorized account. Asset transport and integrity
|
||||
do not establish packaged GUI/server behavior. No Linux checks are included.
|
||||
@@ -0,0 +1,539 @@
|
||||
{
|
||||
"source": "897d9f049406d5be597543eb0a6755b796259302",
|
||||
"platform": "windows",
|
||||
"result": "PASS",
|
||||
"scope": "Documentation/example closure and tracked source identity only; no build or runtime acceptance.",
|
||||
"file_count": 66,
|
||||
"raw_bytes": 1449245,
|
||||
"raw_git_differences": 0,
|
||||
"files": [
|
||||
{
|
||||
"package_path": "LICENSE",
|
||||
"source_path": "LICENSE",
|
||||
"git_blob": "982e1c9a02c8d24faadb208c6284e5b57817dacb",
|
||||
"bytes": 1084,
|
||||
"sha256": "51009f2cb07e5d19645858b2fbc037a672a25f8cbf7999522942b86807ecf365",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "README.md",
|
||||
"source_path": "scripts/package-readme.md",
|
||||
"git_blob": "4588683c69b946260abf84047be16f40e3483670",
|
||||
"bytes": 1902,
|
||||
"sha256": "597cfb8da873e019d2658420f18ec059f0185fa9106ff9eafe934dfdd6ed266b",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "deployment/Dockerfile",
|
||||
"source_path": "deployment/Dockerfile",
|
||||
"git_blob": "198c5c459a7ff8fa3129bb5fa2238ede5c73b19c",
|
||||
"bytes": 1340,
|
||||
"sha256": "72c04aef4ec879955ed3bdf315987553d018ef46e4b8f350f0f6fe380c453eb7",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "deployment/Dockerfile.dockerignore",
|
||||
"source_path": "deployment/Dockerfile.dockerignore",
|
||||
"git_blob": "0c32edaf8327decd61e77e9760830ea93eeacddf",
|
||||
"bytes": 509,
|
||||
"sha256": "6bb7d7496110b11a531cb8cd923864c6610850a8f1c4de8a797f54c7156f29e1",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "deployment/arcadia-server.service",
|
||||
"source_path": "deployment/arcadia-server.service",
|
||||
"git_blob": "bde982f96404e9cca8bc73237c4bb848a714b140",
|
||||
"bytes": 536,
|
||||
"sha256": "1e6c6bb4065e25f8fe1d558a4ed0bbd4844782a4377c2482488db1e6f9cab01d",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/api.html",
|
||||
"source_path": "docs/api.html",
|
||||
"git_blob": "3a07e50c78d3bfcd373a5e99cd2279ec99d66ec8",
|
||||
"bytes": 74641,
|
||||
"sha256": "d06e32b3da838e519630a4151111bb40a383ccf294eb18443118a7498700a993",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/api.rst",
|
||||
"source_path": "docs/api.rst",
|
||||
"git_blob": "ed7617cb37a264270f8cd0a77239e84f9162a222",
|
||||
"bytes": 43564,
|
||||
"sha256": "d78f138d011dd0af28bd53a65d1d93381d031f680191779d4f3030a264eb2e74",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/language.html",
|
||||
"source_path": "docs/language.html",
|
||||
"git_blob": "ddae88761db5e4bfde1ec5086c419ccd031e4d63",
|
||||
"bytes": 191933,
|
||||
"sha256": "77c14e548f5d2deea0c21a3a931347e1c87449f5be8503f6c51ceaef37be9a33",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/language.rst",
|
||||
"source_path": "docs/language.rst",
|
||||
"git_blob": "028db93bec99fb065c26610532c332288d92924c",
|
||||
"bytes": 146279,
|
||||
"sha256": "7117a66e16b34cd6ce033532e984c7ca49b4611e296fb1c46c5f737fe9169ec6",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/linux-packaging.md",
|
||||
"source_path": "docs/linux-packaging.md",
|
||||
"git_blob": "26847e1ec55864f951d1445c56cd3194b9f8bc64",
|
||||
"bytes": 8671,
|
||||
"sha256": "41a1bb1095801df37a1411341c5791d55ea8c365739314d599a60269ac4bc7a0",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/openapi.json",
|
||||
"source_path": "docs/openapi.json",
|
||||
"git_blob": "b4feebe5f7945b27e48551aea1239f23527c1d1f",
|
||||
"bytes": 348802,
|
||||
"sha256": "2ad69da52fb574435525990c906948ce54b1efd9247cdde8726969f382731790",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/preview-human-checks.md",
|
||||
"source_path": "docs/preview-human-checks.md",
|
||||
"git_blob": "be349c4b52be06e0c60e65e39fa5dde1f3f1b3f9",
|
||||
"bytes": 3840,
|
||||
"sha256": "50b56c328c22587e1187f6e614bc914210095cf635c301f335e82de11201b890",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/research-v2-service.md",
|
||||
"source_path": "docs/research-v2-service.md",
|
||||
"git_blob": "d3511c6f546d82253351e21c6ac1103c5f2ba542",
|
||||
"bytes": 36209,
|
||||
"sha256": "4828df5bc679e7c71f49b4b85c9e7dacbec52f46d416fed48af70e08886d4e4e",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/server.md",
|
||||
"source_path": "docs/server.md",
|
||||
"git_blob": "a1eb4c11475c3273d421ede045679231f561491d",
|
||||
"bytes": 23361,
|
||||
"sha256": "4eb24937d424ba8b384e1734e02a6f8e963ae11d2715889c92b14b39ff2e4a48",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "docs/windows-packaging.md",
|
||||
"source_path": "docs/windows-packaging.md",
|
||||
"git_blob": "8805d63b4c3b09476bc1462df7779e715dfc0815",
|
||||
"bytes": 10597,
|
||||
"sha256": "2d5ef8a9a8741e6e7f6df9db9fd9a839f806ea782a6f2063c3a98725ecfd36b6",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/coastal-rescue.arcadia",
|
||||
"source_path": "examples/coastal-rescue.arcadia",
|
||||
"git_blob": "1785aa23ba4e74f79642b3ec1b11f35fda3cc162",
|
||||
"bytes": 33107,
|
||||
"sha256": "7e183ef9fd8154d3074303f1956cd0d9871c19e3ffc630d333b0bffbd6e30e17",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/coastal-rescue.json",
|
||||
"source_path": "examples/coastal-rescue.json",
|
||||
"git_blob": "77cdcd23552e4ddd89b0953935c1c2143f277e21",
|
||||
"bytes": 49715,
|
||||
"sha256": "242f0b031229a87af5c4ebe5d651defe59c191a6b7a69dc0a77f7e203411f195",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/legacy-v1-coastal-rescue.arcadia",
|
||||
"source_path": "examples/legacy-v1-coastal-rescue.arcadia",
|
||||
"git_blob": "5e1e202faaa9c011b2146eb04540459b0e6eaea2",
|
||||
"bytes": 3449,
|
||||
"sha256": "4dbbbdf8bc7e6cb8e0a81dd678069dae585a9e5187c59bc3665e1fdab3f1a86a",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/legacy-v1-coastal-rescue.oa.json",
|
||||
"source_path": "examples/legacy-v1-coastal-rescue.oa.json",
|
||||
"git_blob": "e0a659c82a872646e6d50931e84cbccc7cf15019",
|
||||
"bytes": 5976,
|
||||
"sha256": "fd0e9dedfb7adb922dc0575cc2b820d40344d639f1d8052bd70363aa59de9c24",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/README.md",
|
||||
"source_path": "examples/release1/README.md",
|
||||
"git_blob": "f6f883d175952d84a1da05bab15db8e333d88d13",
|
||||
"bytes": 11137,
|
||||
"sha256": "113cfb1cf38a98b51bff60442d86a35d636a3d80ef206bece7d53d0aae67f2d5",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/evidence/repair-check.md",
|
||||
"source_path": "examples/release1/evidence/repair-check.md",
|
||||
"git_blob": "b3e9ddf8e67b58c2f9c9650abb23495c81e1acab",
|
||||
"bytes": 1419,
|
||||
"sha256": "f4db17bdca4ecbb1bf0caef01b2da5f1f7f798ab3152b648ce6dd8696a6a68e5",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/expected-diagnostics.json",
|
||||
"source_path": "examples/release1/expected-diagnostics.json",
|
||||
"git_blob": "e93a7fa798e47ea264220bd098df742a3b67d6da",
|
||||
"bytes": 288,
|
||||
"sha256": "3700393d76b940cfc076bf52861bd7b1f43370f8eabce3594531bd0bf1fc851e",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/model.json",
|
||||
"source_path": "examples/release1/model.json",
|
||||
"git_blob": "dd61c402df40b6c300b4e374c52a8fd59870a7f1",
|
||||
"bytes": 134520,
|
||||
"sha256": "ef0ef4006c3e09d5db6e1b621256b3f7d6642f3a7b09cc34607cfbcca830c727",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/model.rs",
|
||||
"source_path": "examples/release1/model.rs",
|
||||
"git_blob": "3f7e6e361f507574de1ba412f6fc3337f2ef3c6c",
|
||||
"bytes": 28776,
|
||||
"sha256": "ddc2d92b0d7699a4cadfbb35ae379f0a68d17f4f5d7df82b4b1afcf8d5425fbe",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/activities/activity_oa_restore_work.arcadia",
|
||||
"source_path": "examples/release1/oa/activities/activity_oa_restore_work.arcadia",
|
||||
"git_blob": "fb4a36e18d4df97faf41e1f59c295a00b554db5a",
|
||||
"bytes": 1130,
|
||||
"sha256": "21cbd7176af8fad68453306f2371ff03e127a994b8796cdf044567332de9686f",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/behavior/process_oa_assessment_procedure.arcadia",
|
||||
"source_path": "examples/release1/oa/behavior/process_oa_assessment_procedure.arcadia",
|
||||
"git_blob": "3824af89fec6186d0a163e3e3629328f0281e7b2",
|
||||
"bytes": 550,
|
||||
"sha256": "23cabc213c264a16c8595414db6acb09248c1cef9cd699f1b0316e5bb82c062a",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/behavior/process_oa_field_procedure.arcadia",
|
||||
"source_path": "examples/release1/oa/behavior/process_oa_field_procedure.arcadia",
|
||||
"git_blob": "20502f8bb58eded51bcb834559c62a85070c9769",
|
||||
"bytes": 1178,
|
||||
"sha256": "9c52086759b7344b4809ceb8d372f65647b16fc24153a03b887faa378c37fe96",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/behavior/process_oa_response.arcadia",
|
||||
"source_path": "examples/release1/oa/behavior/process_oa_response.arcadia",
|
||||
"git_blob": "4970a5a552aa613cc5477abd6892af3cbc6deb33",
|
||||
"bytes": 2560,
|
||||
"sha256": "675798bd19e6b40d03e7076b0e59b110cdaaab7b6d16c47c3ac80fa960072e84",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/behavior/scenario_oa_conversation.arcadia",
|
||||
"source_path": "examples/release1/oa/behavior/scenario_oa_conversation.arcadia",
|
||||
"git_blob": "83c3f1d470180f8eb68b722b5485403dfdd588be",
|
||||
"bytes": 1515,
|
||||
"sha256": "e217e5394a0771dc16206ed9437a231da27905d2f19be64b3f48281c0a32fb6b",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/behavior/scenario_oa_full_scenario.arcadia",
|
||||
"source_path": "examples/release1/oa/behavior/scenario_oa_full_scenario.arcadia",
|
||||
"git_blob": "1ff7d7e428409d05e9a3deb3e58907e6ad681238",
|
||||
"bytes": 1121,
|
||||
"sha256": "c5a285f2d7c61bd2a136107f267fbf9cddb1cba3f63ff36a6f53f7ab98f33df5",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/behavior/state_machine_oa_monitor.arcadia",
|
||||
"source_path": "examples/release1/oa/behavior/state_machine_oa_monitor.arcadia",
|
||||
"git_blob": "5ccabfc4b40c94ea86a3faa0f47bbe1774422be5",
|
||||
"bytes": 1358,
|
||||
"sha256": "e7349e1e5336282eed3f5a103129db33d3ae4ed500788ee7129e8fc193ac57f6",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/capabilities.arcadia",
|
||||
"source_path": "examples/release1/oa/capabilities.arcadia",
|
||||
"git_blob": "d7c2acda6debe1c8e59a713ad004c32cbcf8905b",
|
||||
"bytes": 630,
|
||||
"sha256": "26a3d9b615a3251ff010e0b47127f2d16bc2dcd45ed95967208b0076d725843a",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/model.arcadia",
|
||||
"source_path": "examples/release1/oa/model.arcadia",
|
||||
"git_blob": "f2308e9498d30eeb70801768d08065a65f8bdf51",
|
||||
"bytes": 531,
|
||||
"sha256": "069a5eaaf525089935cc9d73ae7b916866ed78c6534705d75739650ecdea7ada",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/participants.arcadia",
|
||||
"source_path": "examples/release1/oa/participants.arcadia",
|
||||
"git_blob": "7edbab4457bca6558bab088380980bae5b8a6444",
|
||||
"bytes": 1580,
|
||||
"sha256": "591a75a9ecad280302be4d4ae0171ad616377ed11ead5e233848ca2dc0a71819",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/oa/types.arcadia",
|
||||
"source_path": "examples/release1/oa/types.arcadia",
|
||||
"git_blob": "c4597556ff22e34f2b1016716ed2a653528b536c",
|
||||
"bytes": 554,
|
||||
"sha256": "f02c391d584674c879f662a418abba3a220f1fee88471ca49322ac9873de628d",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/project.arcadia",
|
||||
"source_path": "examples/release1/project.arcadia",
|
||||
"git_blob": "702dd7a313c1d135ce02a961b6fd5e19f8fc5967",
|
||||
"bytes": 1958,
|
||||
"sha256": "b2674e6bf77cfe0f6f0ba79c81d2e96d92f39c02ca2c6266d80e91723bfb9fda",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/behavior/process_sa_assessment_procedure.arcadia",
|
||||
"source_path": "examples/release1/sa/behavior/process_sa_assessment_procedure.arcadia",
|
||||
"git_blob": "c368828ea1bd8cc5fd8b5c518e26cda6bebdae23",
|
||||
"bytes": 559,
|
||||
"sha256": "5c414fbdaabf9f9e402b0441fcacf1cacf4dbbc6c822162f028de35abf59be2d",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/behavior/process_sa_field_procedure.arcadia",
|
||||
"source_path": "examples/release1/sa/behavior/process_sa_field_procedure.arcadia",
|
||||
"git_blob": "04ff2eee9e607f65b283be0981e77ed5a4b4c8e5",
|
||||
"bytes": 1187,
|
||||
"sha256": "ece846fdf93857e71a9ab0efcbdf64a5c41c71180f62afa3f79077fffb53b8f2",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/behavior/process_sa_response.arcadia",
|
||||
"source_path": "examples/release1/sa/behavior/process_sa_response.arcadia",
|
||||
"git_blob": "d56a692d2d9f07e9a5535c5a114a77b7090c7198",
|
||||
"bytes": 2569,
|
||||
"sha256": "af7fdda280a917cf626f6e077162d481f9aaad280f8e81330c07d7fe384b1c52",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/behavior/scenario_sa_conversation.arcadia",
|
||||
"source_path": "examples/release1/sa/behavior/scenario_sa_conversation.arcadia",
|
||||
"git_blob": "8f19ca0645be71c5f39f8c459bdf4018063dad90",
|
||||
"bytes": 1847,
|
||||
"sha256": "01339699ec3ee409418d9bb232542f2bcd9419f1e67b183e77700c56bb9f71d2",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/behavior/scenario_sa_full_scenario.arcadia",
|
||||
"source_path": "examples/release1/sa/behavior/scenario_sa_full_scenario.arcadia",
|
||||
"git_blob": "96bbfa559d6472dc49f314638549719466cfee22",
|
||||
"bytes": 1116,
|
||||
"sha256": "5dce6b00a3a441162e8dee3e23d9ca5ab7bed4a24de669b1fba03664a3086dda",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/behavior/state_machine_sa_monitor.arcadia",
|
||||
"source_path": "examples/release1/sa/behavior/state_machine_sa_monitor.arcadia",
|
||||
"git_blob": "3f2dc53341b29f7a5288b2a81055a6175e039b38",
|
||||
"bytes": 1358,
|
||||
"sha256": "17dbcfa5bbfd10fc8e23a325fc950ce853c219b4aa89c74f96278cbb3f34acc8",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/capabilities.arcadia",
|
||||
"source_path": "examples/release1/sa/capabilities.arcadia",
|
||||
"git_blob": "464e751d82793306b0e6da880b60f881e2285a17",
|
||||
"bytes": 630,
|
||||
"sha256": "81706a0ca9d7db2aa0350888b9c00d853885185db2e6b90557d3d51a11c3d645",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/functions/function_sa_audit_thresholds.arcadia",
|
||||
"source_path": "examples/release1/sa/functions/function_sa_audit_thresholds.arcadia",
|
||||
"git_blob": "a9c49d2b55e2392929229e04c015b61d870808f5",
|
||||
"bytes": 280,
|
||||
"sha256": "27f798f78f36e72b38edab3725af2feb0eaa010fd52a60b5c6b6bef57ad3b686",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/functions/function_sa_restore_work.arcadia",
|
||||
"source_path": "examples/release1/sa/functions/function_sa_restore_work.arcadia",
|
||||
"git_blob": "7a84b35b4a553cf9387715b5014086ab6e5453fb",
|
||||
"bytes": 2251,
|
||||
"sha256": "357c6acb80f86b4e8d8f5c98f9f79d140f85fbe09f3406b41b7ac6eba464ec8c",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/model.arcadia",
|
||||
"source_path": "examples/release1/sa/model.arcadia",
|
||||
"git_blob": "47f9ff5414fb23a955884c2702bc2289d989f1a1",
|
||||
"bytes": 531,
|
||||
"sha256": "805b90262e27090ae7da81a51bcefa49c97fb0b3d3220b4a72323b4c4351c395",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/participants.arcadia",
|
||||
"source_path": "examples/release1/sa/participants.arcadia",
|
||||
"git_blob": "3bb62d30049dbc84d73841fb549a4e1abca80777",
|
||||
"bytes": 3604,
|
||||
"sha256": "ca144d6a8f45fe720b5d18c7b59c7671444baa8c37e5ce9117bcba34b3a6aa84",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/sa/types.arcadia",
|
||||
"source_path": "examples/release1/sa/types.arcadia",
|
||||
"git_blob": "e876932a0b236c6a022a1361b39d5ffb1185d0b1",
|
||||
"bytes": 903,
|
||||
"sha256": "540ddbc2bcd0ccf45298e3ea5660637341aff63ff65fd87ac2f26469d1adc064",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/traceability.arcadia",
|
||||
"source_path": "examples/release1/traceability.arcadia",
|
||||
"git_blob": "6a5bb1021368d9958baa469030bdb1464188c69e",
|
||||
"bytes": 28041,
|
||||
"sha256": "474bd28d955ff7af7722f6e9a23220d816879e3f46202e79a233544b9c593116",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/transition-before.json",
|
||||
"source_path": "examples/release1/transition-before.json",
|
||||
"git_blob": "71f12774cb2192e2ab2627b57cd365ef0d21fb66",
|
||||
"bytes": 35801,
|
||||
"sha256": "2253e6434f741687e22327c37d520ed15c043bc36025498650bc2366bb6a874d",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/transition-request.json",
|
||||
"source_path": "examples/release1/transition-request.json",
|
||||
"git_blob": "b2cc442b89e14d9753996f1c32c0fb5aeb702758",
|
||||
"bytes": 4276,
|
||||
"sha256": "43b9a22e5f95ad3bc0ebd2478ead0e14406854abc989ae94ded9367b013d812a",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/views/diagram_oa_allocation_view.arcadia",
|
||||
"source_path": "examples/release1/views/diagram_oa_allocation_view.arcadia",
|
||||
"git_blob": "05bf689092f251b732c962cff2573e8e2e891dd9",
|
||||
"bytes": 1786,
|
||||
"sha256": "c45d7467839219d894804c1ef2d22ff4d4a5a84a6a273c526bafd4c1facde624",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/views/diagram_sa_allocation_view.arcadia",
|
||||
"source_path": "examples/release1/views/diagram_sa_allocation_view.arcadia",
|
||||
"git_blob": "ff60c8b80951b83a85f10e82d6d9807905264fae",
|
||||
"bytes": 1797,
|
||||
"sha256": "352a3ca745517592b5c9b1239b5770f62f0466a329a91fd03457ef2b53c06ed6",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/views/diagram_sa_capability_view.arcadia",
|
||||
"source_path": "examples/release1/views/diagram_sa_capability_view.arcadia",
|
||||
"git_blob": "9033d91ef18d87f736190e1d8ac28771ffc9f8a8",
|
||||
"bytes": 1286,
|
||||
"sha256": "8f18fcccbcddcf3c1ea0ffe727b5b23b77fc148c5da4fde953abe681e4c20cd2",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/views/diagram_sa_service_view.arcadia",
|
||||
"source_path": "examples/release1/views/diagram_sa_service_view.arcadia",
|
||||
"git_blob": "90d331f08b89b718b01fb069457b3271eaa2babc",
|
||||
"bytes": 1960,
|
||||
"sha256": "4c72cb7593d9c4be8d2600b0656a7a3a6ce84c45bb2f3e58a4ee5ae3bf91913c",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/release1/views/diagram_sa_state_view.arcadia",
|
||||
"source_path": "examples/release1/views/diagram_sa_state_view.arcadia",
|
||||
"git_blob": "37116b80d8caa61e5deb1a2d73cd2b6df12d20a0",
|
||||
"bytes": 1576,
|
||||
"sha256": "dd1bea81ac7dc549a53f9b190be6f13052e00ede345bd180444cc31edb892230",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/routing-workshop.arcadia",
|
||||
"source_path": "examples/routing-workshop.arcadia",
|
||||
"git_blob": "d136d37ed3a298bd46c98c668f29297ff5b4f241",
|
||||
"bytes": 66431,
|
||||
"sha256": "dc6b75da72884d399132ed9e300fa5a26b73d802bb526c9af986ae9eeb0a646a",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/routing-workshop.json",
|
||||
"source_path": "examples/routing-workshop.json",
|
||||
"git_blob": "f67fa011a25d16348e055f66ef3aa69d7a9375bb",
|
||||
"bytes": 100281,
|
||||
"sha256": "8592714f75b271133f21ce017d87896b6cf91ea0e4837f1c2ed453e21be26b14",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/source-project/oa.arcadia",
|
||||
"source_path": "examples/source-project/oa.arcadia",
|
||||
"git_blob": "0aa8c9ddbfcc1fb2287559d9cc529898dedd1b97",
|
||||
"bytes": 2142,
|
||||
"sha256": "5f60642f211b2d352a951092faeeb7503d4fb7f6f7fca99e810347231101d31c",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/source-project/project.arcadia",
|
||||
"source_path": "examples/source-project/project.arcadia",
|
||||
"git_blob": "8bb4292f25b31ea53af9cac665a9043fd2130dc7",
|
||||
"bytes": 606,
|
||||
"sha256": "787f6b67b179ffd221f7e5faf1a4edd74cfd116aa1e3b5e9ed9f22fbff612d8d",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/source-project/sa/assurance.arcadia",
|
||||
"source_path": "examples/source-project/sa/assurance.arcadia",
|
||||
"git_blob": "b9678cbee4c3210e20131e363b915a1afc4b272a",
|
||||
"bytes": 682,
|
||||
"sha256": "ab76044836e4dcd42a82d316846ec87da2108939aa2037640c5bca1d2ecdee0f",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/source-project/sa/participants.arcadia",
|
||||
"source_path": "examples/source-project/sa/participants.arcadia",
|
||||
"git_blob": "cdd7f402b0f4327c8382763f7dd9def702759c0c",
|
||||
"bytes": 1231,
|
||||
"sha256": "1abad579812e77877b45a3d8e3c3e9da734be2d04a0254cc730a5257ebd2dc88",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/source-project/sa/reporting.arcadia",
|
||||
"source_path": "examples/source-project/sa/reporting.arcadia",
|
||||
"git_blob": "bfeac4b0b37ab3166c149ce482e99e8ea40419ba",
|
||||
"bytes": 2839,
|
||||
"sha256": "f0b7443f728912ca163de39b6055876b533a77feaa3219b2d40a2dd65712e058",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/source-project/views.arcadia",
|
||||
"source_path": "examples/source-project/views.arcadia",
|
||||
"git_blob": "62d9b5cbac461a2bc7dda6f91686ab741a93c14b",
|
||||
"bytes": 3508,
|
||||
"sha256": "e29ad3f406a6a50d2f0ae2ca2a53ee3b0c18222cd4098704a46d4f48b64ea17f",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/text-first/README.md",
|
||||
"source_path": "examples/text-first/README.md",
|
||||
"git_blob": "4f7832723554eb57dfdae9400b57a591ab4a5bbf",
|
||||
"bytes": 1367,
|
||||
"sha256": "4ec8250d5ed556f1d496e8c85137e973e802ecb11df1a36488411e8cdc5a9f9e",
|
||||
"raw_equals_git_blob": true
|
||||
},
|
||||
{
|
||||
"package_path": "examples/text-first/project.arcadia",
|
||||
"source_path": "examples/text-first/project.arcadia",
|
||||
"git_blob": "e6d0e9c65ea866a3c8702e234bb45801191c8629",
|
||||
"bytes": 480,
|
||||
"sha256": "f441535c623e0cf20e1875eb2cd33b587ed00e078c37af39cb36d89bb5edc19a",
|
||||
"raw_equals_git_blob": true
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"release_id": 7,
|
||||
"asset_id": 25,
|
||||
"name": "ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip",
|
||||
"bytes": 34168661,
|
||||
"sha256": "5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d",
|
||||
"download_url": "http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/download/v0.2.0-preview.integrated.20260924/ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip"
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
"""Inspect a downloaded Windows ZIP without extracting or running its contents.
|
||||
|
||||
Expected archive/binary hashes must come from separately reviewed build evidence.
|
||||
This checks artifact integrity and provenance assertions, not native acceptance.
|
||||
"""
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path, PurePosixPath
|
||||
import re
|
||||
import stat
|
||||
import zipfile
|
||||
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('archive', type=Path)
|
||||
for option in ('archive-sha256', 'source', 'version', 'desktop-sha256', 'server-sha256', 'runtime-sha256'):
|
||||
parser.add_argument('--' + option, required=True)
|
||||
parser.add_argument('--documents-receipt', required=True, type=Path)
|
||||
args = parser.parse_args()
|
||||
|
||||
def sha(raw):
|
||||
return hashlib.sha256(raw).hexdigest()
|
||||
|
||||
for value in (args.archive_sha256, args.desktop_sha256, args.server_sha256, args.runtime_sha256):
|
||||
assert re.fullmatch(r'[0-9a-f]{64}', value), 'Expected lowercase SHA256 required'
|
||||
assert re.fullmatch(r'[0-9a-f]{40}', args.source), 'Exact source commit required'
|
||||
assert sha(args.archive.read_bytes()) == args.archive_sha256, 'Archive checksum differs'
|
||||
target = 'x86_64-pc-windows-gnullvm'
|
||||
root = f'ArcadiaStudio-{args.version}-{target}/'
|
||||
expected_binaries = {'arcadia-studio.exe': args.desktop_sha256,
|
||||
'arcadia-server.exe': args.server_sha256,
|
||||
'libunwind.dll': args.runtime_sha256}
|
||||
with zipfile.ZipFile(args.archive) as archive:
|
||||
infos = archive.infolist()
|
||||
assert sum(row.file_size for row in infos) <= 1024 ** 3, 'Unexpected package size'
|
||||
assert len({row.filename.casefold() for row in infos}) == len(infos), 'Duplicate/case-colliding archive members'
|
||||
files = {}
|
||||
for row in infos:
|
||||
name = row.filename
|
||||
path = PurePosixPath(name)
|
||||
assert not path.is_absolute() and '..' not in path.parts and '\\' not in name and ':' not in name
|
||||
assert name.startswith(root), 'Unexpected archive root'
|
||||
assert not stat.S_ISLNK(row.external_attr >> 16), 'Symlink archive member'
|
||||
if not row.is_dir():
|
||||
relative = name[len(root):]
|
||||
assert relative and relative not in files
|
||||
files[relative] = sha(archive.read(row))
|
||||
|
||||
def read(name):
|
||||
assert name in files, 'Missing required package member: ' + name
|
||||
return archive.read(root + name)
|
||||
|
||||
checksums = {}
|
||||
for line in read('SHA256SUMS.txt').decode('utf-8-sig').splitlines():
|
||||
match = re.fullmatch(r'([0-9a-f]{64}) (.+)', line)
|
||||
assert match, 'Malformed package checksum line'
|
||||
digest, name = match.groups()
|
||||
assert name not in checksums, 'Duplicate package checksum path'
|
||||
checksums[name] = digest
|
||||
assert set(files) == set(checksums) | {'SHA256SUMS.txt'}, 'Missing or unexpected package files'
|
||||
assert 'SHA256SUMS.txt' not in checksums
|
||||
assert all(files[name] == digest for name, digest in checksums.items()), 'Package file checksum differs'
|
||||
metadata = json.loads(read('package.json'))
|
||||
assert metadata['version'] == args.version and metadata['target'] == target
|
||||
for name, digest in metadata['input_sha256'].items():
|
||||
assert files.get(name) == digest, 'Package input differs: ' + name
|
||||
for name, digest in expected_binaries.items():
|
||||
assert files.get(name) == metadata['input_sha256'].get(name) == digest, 'Build artifact differs: ' + name
|
||||
build = metadata['build_evidence']['evidence']
|
||||
assert build['source_identity'] == args.source, 'Source assertion needs exact commit or explicit review'
|
||||
assert build['profile'] == 'dev' and build['target'] == target and build['compiler']
|
||||
for name in ('arcadia-studio.exe', 'arcadia-server.exe'):
|
||||
assert build['binary_sha256'][name] == expected_binaries[name]
|
||||
for name in ('README.md', 'START-HERE.txt', 'LICENSE', 'docs/windows-packaging.md',
|
||||
'docs/preview-human-checks.md', 'THIRD-PARTY-NOTICES.txt', 'dependency-notices.json'):
|
||||
read(name)
|
||||
document_check = json.loads(read('documentation-check.json'))
|
||||
assert 'checked_local_document_links' in document_check
|
||||
notices = json.loads(read('dependency-notices.json'))
|
||||
assert notices['target'] == target and notices['runtime']['sha256'] == args.runtime_sha256
|
||||
documents = json.loads(args.documents_receipt.read_text(encoding='utf-8-sig'))
|
||||
assert documents['result'] == 'PASS' and len(documents['files']) == documents['file_count']
|
||||
for row in documents['files']:
|
||||
assert files.get(row['package_path']) == row['sha256'], 'Reviewed document bytes differ: ' + row['package_path']
|
||||
print(json.dumps({'archive': args.archive.name, 'archive_sha256': args.archive_sha256,
|
||||
'version': args.version, 'source_assertion': args.source,
|
||||
'package_files': len(files), 'uncompressed_bytes': sum(row.file_size for row in infos),
|
||||
'verified_binary_sha256': expected_binaries,
|
||||
'reviewed_document_files': len(documents['files']),
|
||||
'document_links': document_check['checked_local_document_links'],
|
||||
'compiler_assertion': build['compiler'], 'imports': metadata['imports'],
|
||||
'scope': 'Archive integrity, supplied build hashes and reviewed document bytes; no binary execution or native acceptance.'}, indent=2))
|
||||
@@ -0,0 +1,74 @@
|
||||
{
|
||||
"archive": "ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip",
|
||||
"archive_sha256": "5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d",
|
||||
"version": "0.2.0-preview.integrated.20260924",
|
||||
"source_assertion": "715036e132677dd2bc2fb37ed316d93dc9987aec",
|
||||
"package_files": 565,
|
||||
"uncompressed_bytes": 182276890,
|
||||
"verified_binary_sha256": {
|
||||
"arcadia-studio.exe": "2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399",
|
||||
"arcadia-server.exe": "6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237",
|
||||
"libunwind.dll": "aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a"
|
||||
},
|
||||
"reviewed_document_files": 66,
|
||||
"document_links": 18,
|
||||
"compiler_assertion": "rustc 1.98.1 (48a229cea 2026-09-01)",
|
||||
"imports": {
|
||||
"arcadia-studio.exe": [
|
||||
"advapi32.dll",
|
||||
"api-ms-win-core-synch-l1-2-0.dll",
|
||||
"api-ms-win-crt-environment-l1-1-0.dll",
|
||||
"api-ms-win-crt-heap-l1-1-0.dll",
|
||||
"api-ms-win-crt-locale-l1-1-0.dll",
|
||||
"api-ms-win-crt-math-l1-1-0.dll",
|
||||
"api-ms-win-crt-private-l1-1-0.dll",
|
||||
"api-ms-win-crt-runtime-l1-1-0.dll",
|
||||
"api-ms-win-crt-stdio-l1-1-0.dll",
|
||||
"api-ms-win-crt-string-l1-1-0.dll",
|
||||
"bcrypt.dll",
|
||||
"bcryptprimitives.dll",
|
||||
"dwmapi.dll",
|
||||
"gdi32.dll",
|
||||
"imm32.dll",
|
||||
"kernel32.dll",
|
||||
"libunwind.dll",
|
||||
"ntdll.dll",
|
||||
"ole32.dll",
|
||||
"oleaut32.dll",
|
||||
"opengl32.dll",
|
||||
"shell32.dll",
|
||||
"user32.dll",
|
||||
"uxtheme.dll",
|
||||
"ws2_32.dll"
|
||||
],
|
||||
"arcadia-server.exe": [
|
||||
"api-ms-win-core-synch-l1-2-0.dll",
|
||||
"api-ms-win-crt-environment-l1-1-0.dll",
|
||||
"api-ms-win-crt-heap-l1-1-0.dll",
|
||||
"api-ms-win-crt-locale-l1-1-0.dll",
|
||||
"api-ms-win-crt-math-l1-1-0.dll",
|
||||
"api-ms-win-crt-private-l1-1-0.dll",
|
||||
"api-ms-win-crt-runtime-l1-1-0.dll",
|
||||
"api-ms-win-crt-stdio-l1-1-0.dll",
|
||||
"api-ms-win-crt-string-l1-1-0.dll",
|
||||
"bcryptprimitives.dll",
|
||||
"kernel32.dll",
|
||||
"libunwind.dll",
|
||||
"ntdll.dll",
|
||||
"ws2_32.dll"
|
||||
],
|
||||
"libunwind.dll": [
|
||||
"api-ms-win-crt-convert-l1-1-0.dll",
|
||||
"api-ms-win-crt-environment-l1-1-0.dll",
|
||||
"api-ms-win-crt-filesystem-l1-1-0.dll",
|
||||
"api-ms-win-crt-heap-l1-1-0.dll",
|
||||
"api-ms-win-crt-locale-l1-1-0.dll",
|
||||
"api-ms-win-crt-private-l1-1-0.dll",
|
||||
"api-ms-win-crt-runtime-l1-1-0.dll",
|
||||
"api-ms-win-crt-stdio-l1-1-0.dll",
|
||||
"api-ms-win-crt-string-l1-1-0.dll",
|
||||
"kernel32.dll"
|
||||
]
|
||||
},
|
||||
"scope": "Archive integrity, supplied build hashes and reviewed document bytes; no binary execution or native acceptance."
|
||||
}
|
||||
@@ -33,6 +33,9 @@ metadata and its integrity; it did not independently analyze executable imports,
|
||||
regenerate dependency notices or run the packaged products. The separate
|
||||
downloaded-package QA and native/server evidence remain required.
|
||||
|
||||
The [inspector, raw JSON output and document pins](../experiments/prerelease37-package-integrity-20260924/README.md)
|
||||
are retained for read-only reproduction against a freshly downloaded ZIP.
|
||||
|
||||
The two companion kit ZIPs and their SHA files (assets21–24) were also uploaded
|
||||
to this draft and freshly downloaded byte-for-byte. State/Traceability ZIP:
|
||||
9,691 bytes, SHA-256
|
||||
|
||||
Reference in New Issue
Block a user