WIP: fix(builder): validate Python setup manifests before installation #2060

Closed

Arkex-ai wants to merge 1 commit from fix/python-setup-manifest into main

Arkex-ai commented

2026-11-11 01:28:42 +00:00

(Migrated from github.com)

Summary

The Python Builder used release metadata to choose installation paths before checking its format. It now rejects invalid setup lists before touching the installation and reuses a cached part only when the recorded digest matches exactly.

Addresses item 3 in #2045.

Technical changes

Validate release names, destination and rename fields, SHA-256, size and HTTPS URLs before starting the install.
Check the installed version name before looking up reusable parts. Read recorded digests as whole lines.
Keep the existing release format, including prerelease tags and the external LLVM archive.

Validation

At bcbe823f on 667ba79b, the Windows and Ubuntu tests accepted all 8 parts from an authored package run through the official release generator.
The same tests rejected 9 invalid manifest cases before the install directory was requested. A temporary-directory test verified that cache reuse requires a complete digest match.
Read-only checks accepted all eight parts in the published stable, RC1 and Nightly manifests. The RC2 setup asset returned HTTP 404 when checked.
The hosted Windows source shard hit the pre-existing HKSTATE2 fixture compile error. The same failure is documented on #2046.

Dev-work claim.

Current-head check	Result
Linux AppImage	In progress
Windows build	In progress
Source suite	Windows shard failed on HKSTATE2 fixture

## Summary The Python Builder used release metadata to choose installation paths before checking its format. It now rejects invalid setup lists before touching the installation and reuses a cached part only when the recorded digest matches exactly. Addresses item 3 in #2045. ## Technical changes - Validate release names, destination and rename fields, SHA-256, size and HTTPS URLs before starting the install. - Check the installed version name before looking up reusable parts. Read recorded digests as whole lines. - Keep the existing release format, including prerelease tags and the external LLVM archive. ## Validation - At `bcbe823f` on `667ba79b`, the Windows and Ubuntu tests accepted all **8 parts** from an authored package run through the official release generator. - The same tests rejected **9 invalid manifest cases** before the install directory was requested. A temporary-directory test verified that cache reuse requires a complete digest match. - Read-only checks accepted all eight parts in the published stable, RC1 and Nightly manifests. The RC2 setup asset returned HTTP 404 when checked. - The hosted Windows source shard hit the pre-existing HKSTATE2 fixture compile error. The same failure is documented on #2046. [Dev-work claim](https://discord.com/channels/1568810484818378804/1569019786766188665/1569885732133142559).  | Current-head check | Result | |---|---| | [Linux AppImage](https://github.com/NotRexed/Hookshot/actions/runs/42939238739) | In progress | | [Windows build](https://github.com/NotRexed/Hookshot/actions/runs/42939238804) | In progress | | [Source suite](https://github.com/NotRexed/Hookshot/actions/runs/42939238766) | Windows shard failed on HKSTATE2 fixture |

Arkex-ai commented

2026-11-11 01:37:29 +00:00

(Migrated from github.com)

Closing in favor of the earlier #2057, which covers the same item in #2045. The read-only compatibility checks here accepted the published stable, RC1 and Nightly manifests, eight parts each.

Commenting is not possible because the repository is archived.

No reviewers