Verify recorded source manifest SHA and immutable legacy history

This commit is contained in:
NINI
2026-10-05 02:37:55 +09:00
parent 8afff106da
commit ceb063dfdc
3 changed files with 61 additions and 1 deletions
+33
View File
@@ -223,6 +223,39 @@ class VoiceHistoryTests(unittest.TestCase):
self.assertEqual([], voice.validate_manifest(legacy, self.catalog, self.profile, self.root))
self.assertEqual(saved_manifest, (self.root / 'generated' / manifest['runId'] / 'manifest.json').read_bytes())
def test_reuse_rejects_origin_manifest_device_changed_after_sha_recording(self):
first = self.run_generation()
entries = voice.reusable_entries(self.root, self.catalog, self.profile)
with mock.patch.object(voice.importlib.metadata, 'version', return_value='test-version'), \
mock.patch.object(voice.subprocess, 'run', return_value=mock.Mock(stdout='Test GPU\n')):
environment = voice.reuse_environment(self.profile, entries, self.root)
second = voice.generate(self.catalog, self.profile, self.root, environment=environment)
self.assertEqual([], voice.validate_manifest(second, self.catalog, self.profile, self.root))
changed_reference = copy.deepcopy(second)
changed_reference['environment']['sourceGenerations'][0]['manifestSha256'] = '0' * 64
self.assertTrue(voice.validate_manifest(changed_reference, self.catalog, self.profile, self.root))
changed_environment = copy.deepcopy(second)
changed_environment['environment']['sourceGenerations'][0]['environment']['device'] = 'CORRUPTED_DEVICE_RECORD'
self.assertTrue(voice.validate_manifest(changed_environment, self.catalog, self.profile, self.root))
origin = self.root / 'generated' / first['runId'] / 'manifest.json'
changed = voice.load_json(origin)
changed['environment']['device'] = 'CORRUPTED_DEVICE_RECORD'
voice.write_json(origin, changed)
self.assertTrue(voice.validate_manifest(second, self.catalog, self.profile, self.root))
def test_legacy_migration_sha_seals_manifest_without_freezing_mutable_inputs(self):
manifest = self.run_generation()
path = self.root / 'generated' / manifest['runId'] / 'manifest.json'
voice.write_json(self.root / 'input-snapshot-migration.json', {
'schemaVersion': 1, 'runs': [{'runId': manifest['runId'], 'originalManifestSha256': voice.file_hash(path)}],
'preservedArtifactSha256': {'qwen-profile.json': 'old mutable file hash'}})
voice.write_json(self.root / 'qwen-profile.json', {'seed': 43})
self.assertEqual([], voice.validate_manifest(manifest, self.catalog, self.profile, self.root))
changed = voice.load_json(path)
changed['environment']['device'] = 'CORRUPTED_DEVICE_RECORD'
voice.write_json(path, changed)
self.assertTrue(voice.validate_manifest(changed, self.catalog, self.profile, self.root))
if __name__ == '__main__':
unittest.main()