aicctv
949c6d05c3
The offline bundle shipped unpinned pip deps with no digests, no SBOM, and no signature — an air-gap target can't re-resolve from PyPI, so a truncated or tampered wheel would install silently. build_offline_bundle.sh now emits, from the resolved wheelhouse: - SHA256SUMS — sha256 of every wheel + model - requirements.lock — exact name==version pins for a reproducible rebuild - sbom.json — CycloneDX 1.5 components (name, version, pypi purl, sha256) - SHA256SUMS.asc — optional detached GPG signature when SIGN_KEY is set MANIFEST advertises the integrity set and whether it is signed. install_offline.sh verifies `sha256sum -c SHA256SUMS` (and the signature, if present) BEFORE any pip install, hard-failing on mismatch; older bundles without the file pass with a warning. The generation logic was verified end-to-end on a synthetic stage: requirements.lock/SHA256SUMS correct, `sha256sum -c` passes, sbom.json is valid CycloneDX JSON. Both scripts pass `bash -n`. Tests (test_deploy_artifacts.py): pinned integrity manifest is emitted (+ optional SIGN_KEY), installer verifies integrity before install. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW |
||
|---|---|---|
| cloud | ||
| deploy | ||
| docs | ||
| edge | ||
| tests | ||
| .gitattributes | ||
| .gitignore | ||
| pyproject.toml | ||