feat: add SHA-256 checksums to pack release metadata#4
Conversation
Compute and emit a sha256: prefixed checksum for each pack version's files map. The canonical form is compact JSON with sorted keys, matching the weave client's checksum::compute() function. Companion to breferrari/weave#240.
There was a problem hiding this comment.
Pull request overview
Adds per-version SHA-256 checksums to the registry’s pack release metadata, enabling clients (e.g., the Rust weave client) to validate pack contents deterministically.
Changes:
- Add checksum computation to
scripts/generate.pybased on canonical JSON serialization of each version’sfilesmap. - Include a
checksum: "sha256:{hex}"field in each generated pack version entry. - Regenerate
packs/*.jsonoutputs to include the new checksum field.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 15 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/generate.py | Introduces compute_checksum() and emits a checksum field per version during generation. |
| packs/brave-search.json | Generated output updated to include checksum for the version entry. |
| packs/docs-writer.json | Generated output updated to include checksum for the version entry. |
| packs/fetch.json | Generated output updated to include checksum for the version entry. |
| packs/filesystem.json | Generated output updated to include checksum for the version entry. |
| packs/git-tools.json | Generated output updated to include checksum for the version entry. |
| packs/github.json | Generated output updated to include checksum for the version entry. |
| packs/memory.json | Generated output updated to include checksum for the version entry. |
| packs/postgres.json | Generated output updated to include checksum for the version entry. |
| packs/python-dev.json | Generated output updated to include checksum for the version entry. |
| packs/rust-dev.json | Generated output updated to include checksum for the version entry. |
| packs/sequential-thinking.json | Generated output updated to include checksum for the version entry. |
| packs/sqlite.json | Generated output updated to include checksum for the version entry. |
| packs/web-dev.json | Generated output updated to include checksum for the version entry. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "dependencies": {}, | ||
| "checksum": "sha256:86f6936a2a799d0e835c4c29748aad00674bc89369e03ed049e083ee3645bb9a" |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:c1da7192c923c801df32afde883028d309c8de41ea735ce275f79eed56b5ffe4" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:e43a5227785e95058bb21f2c3983ee2b2e7c9056005ef41a0ca59a5d041de120" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:7b3a9703a2c11bc08c149ae7442462f65e4aea73c0a0d200476ef45d94dab11c" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:233a4c209f0fec43bb5c618a0ab25bd063a407132e948b2f66962a803d24133a" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:27c04b551c876abea94fdb48a3d3985c10339eacfe0f9f9a088b3cb20011c45e" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:94767227fa0402e052cb06c07a309001d47657b30ab7d0104798e17a9588f931" |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:21fe8d2b695b39ddd1bfbea11af8067afda2d069f041c1a4a9bcfa306766046c" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:7bf489e44de1ca60bac9fc51fbf5764a209391e8ea7259966ed1fc3eee7150ab" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
| "dependencies": {}, | ||
| "checksum": "sha256:167c89ccd2355ce79fb9d8fc1df447c07368d97ebc093364456c3367c681b153" | ||
| } |
There was a problem hiding this comment.
Repository docs state that packs/*.json are generated artifacts and should not be edited in PRs; CI regenerates them on merge. Consider dropping changes to this file (and other packs/*.json) from the PR and letting the publish workflow commit regenerated outputs after merge.
Summary
generate.pynow computes SHA-256 checksums over the canonical JSON of each version's files mappacks/{name}.jsonversion entry includes a"checksum": "sha256:{hex}"fieldjson.dumps(files, sort_keys=True, separators=(',', ':'))— matches the Rust client exactlyCompanion to breferrari/weave#240.
Test plan
generate.pyruns successfully on all 13 packspacks/*.jsonnow includes achecksumfield