Function verify_tar

scripts/ci/verify-release-selection.py:280–322

(
    path: pathlib.Path, *, required_member: str, expected_sha256: str,
    expected_size: int, require_executable_mode: bool
)

def verify_tar(
    path: pathlib.Path, *, required_member: str, expected_sha256: str,
    expected_size: int, require_executable_mode: bool
) -> None:
    matches = 0
    try:
        with tarfile.open(path, mode="r:gz") as archive:
            members = archive.getmembers()
            if not members or len(members) > MAX_MEMBERS:
                raise ContractError(f"tar member count is invalid: {path.name}")
            if sum(member.size for member in members) > MAX_TOTAL_MEMBER_BYTES:
                raise ContractError(f"tar exceeds total member-size ceiling: {path.name}")
            seen: set[str] = set()
            for member in members:
                if not safe_member_name(member.name) or member.name in seen:
                    raise ContractError(f"tar has unsafe or duplicate member: {path.name}:{member.name}")
                seen.add(member.name)
                if member.issym() or member.islnk() or member.isdev() or member.isfifo():
                    raise ContractError(f"tar contains a special member: {path.name}:{member.name}")
                if member.size > MAX_MEMBER_BYTES:
                    raise ContractError(f"tar member exceeds size ceiling: {path.name}:{member.name}")
                if member.name != required_member:
                    continue
                if not member.isfile():
                    raise ContractError(f"required tar executable is not regular: {path.name}")
                if require_executable_mode and stat.S_IMODE(member.mode) != 0o755:
                    raise ContractError(
                        f"required tar executable has wrong mode: {path.name}:{member.name}"
                    )
                matches += 1
                handle = archive.extractfile(member)
                if handle is None:
                    raise ContractError(f"required tar executable is unreadable: {path.name}")
                with handle:
                    actual_sha256, actual_size = hash_stream(
                        handle, declared_size=member.size, label=f"{path.name}:{member.name}"
                    )
                if actual_sha256 != expected_sha256 or actual_size != expected_size:
                    raise ContractError(f"tar executable does not match selection: {path.name}")
    except (tarfile.TarError, EOFError) as error:
        raise ContractError(f"malformed tar archive: {path.name}") from error
    if matches != 1:
        raise ContractError(f"tar must contain exactly one required executable: {path.name}")


def zip_entry_kind(info: zipfile.ZipInfo) -> str: