36 lines
1.5 KiB
Python
36 lines
1.5 KiB
Python
"""Build-input identity for detecting stale, otherwise checksum-valid runtimes."""
|
|
import hashlib
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
UPSTREAM_COMMIT = "4d756bc72bf00a4aacf410ae15a2d315f3db400d"
|
|
INPUTS = (
|
|
"crates/searchi-semantic/native/worker.cpp",
|
|
"crates/searchi-semantic/native/CMakeLists.txt",
|
|
"tools/embeddinggemma2/build_runtime.py",
|
|
"tools/embeddinggemma2/macos_runtime.py",
|
|
"tools/embeddinggemma2/no-logits.patch",
|
|
"tools/embeddinggemma2/cpu-dispatch.patch",
|
|
"tools/embeddinggemma2/cpu-only-loader.patch",
|
|
)
|
|
|
|
|
|
def fingerprint(root=ROOT):
|
|
hashes = {}
|
|
for name in INPUTS:
|
|
path = Path(root) / name
|
|
with path.open("rb") as source:
|
|
data = source.read(1024 * 1024 + 1)
|
|
if not data or len(data) > 1024 * 1024:
|
|
raise ValueError("Native build input is empty or oversized")
|
|
# Only build-source line endings are canonicalized; indexed user bytes
|
|
# and extraction provenance are never processed by this helper.
|
|
hashes[name] = hashlib.sha256(data.replace(b"\r\n", b"\n")).hexdigest()
|
|
return {"schema": 1, "upstream_commit": UPSTREAM_COMMIT,
|
|
"normalization": "CRLF-to-LF build inputs only", "inputs": hashes}
|
|
|
|
|
|
def verify(manifest, root=ROOT):
|
|
if not isinstance(manifest.get("build_provenance"), dict) or manifest["build_provenance"] != fingerprint(root):
|
|
raise ValueError("Runtime build provenance missing or stale; rebuild the normal native runtime")
|