Reproducible 202609 chain, step 8: tools/verify_release.py — hash a release, re-verify any host or mirror against it - #356

Merged

rdhyee merged 6 commits into

isamplesorg:mainfrom

rdhyee:pipeline/verify-release

Aug 28, 2026

Commits on Aug 28, 2026

tools/verify_release.py: hash a release directory; re-verify any host or mirror against it (chain step 8)

rdhyee
and
claude
committed
0c49e0a
verify_release.py: VERIFIED only when nothing was skipped (PARTIAL/3 otherwise); refuse redirects; URL-encode + validate paths; contain --dir; strict GET framing; complete hash mode (Codex round 1)

rdhyee
and
claude
committed
d59a289
verify_release.py: report/out containment, base URL validation, complete walks, strict manifest typing, canonical paths (Codex round 2)

rdhyee
and
claude
committed
bc3c70b
verify_release.py: hard-link-safe writers (samefile + atomic temp/replace), commonpath containment, non-empty release id, 'matched when read' contract (Codex round 3)

rdhyee
and
claude
committed
9ba88b5
verify_release.py: destination checks ignore the final component (symlinks), report written before the verdict and its failure is FAILED (Codex round 4)

rdhyee
and
claude
committed
1ebf74b
verify_release.py: hash requires --out (Codex round 5)

rdhyee
and
claude
committed
4ffe2c6