Function verify_zip

scripts/ci/verify-release-selection.py:332–373

(
    path: pathlib.Path, *, required_member: str, expected_sha256: str,
    expected_size: int, require_executable_mode: bool
)

def verify_zip(
    path: pathlib.Path, *, required_member: str, expected_sha256: str,
    expected_size: int, require_executable_mode: bool
) -> None:
    matches = 0
    try:
        with zipfile.ZipFile(path, mode="r") as archive:
            members = archive.infolist()
            if not members or len(members) > MAX_MEMBERS:
                raise ContractError(f"zip member count is invalid: {path.name}")
            if sum(member.file_size for member in members) > MAX_TOTAL_MEMBER_BYTES:
                raise ContractError(f"zip exceeds total member-size ceiling: {path.name}")
            seen: set[str] = set()
            for member in members:
                name = member.filename
                if not safe_member_name(name) or name in seen:
                    raise ContractError(f"zip has unsafe or duplicate member: {path.name}:{name}")
                seen.add(name)
                if zip_entry_kind(member) == "special":
                    raise ContractError(f"zip contains a special member: {path.name}:{name}")
                if member.file_size > MAX_MEMBER_BYTES:
                    raise ContractError(f"zip member exceeds size ceiling: {path.name}:{name}")
                if name != required_member:
                    continue
                if zip_entry_kind(member) != "regular":
                    raise ContractError(f"required zip executable is not regular: {path.name}")
                mode = (member.external_attr >> 16) & 0xFFFF
                if require_executable_mode and stat.S_IMODE(mode) != 0o755:
                    raise ContractError(
                        f"required zip executable has wrong mode: {path.name}:{name}"
                    )
                matches += 1
                with archive.open(member, mode="r") as handle:
                    actual_sha256, actual_size = hash_stream(
                        handle, declared_size=member.file_size, label=f"{path.name}:{name}"
                    )
                if actual_sha256 != expected_sha256 or actual_size != expected_size:
                    raise ContractError(f"zip executable does not match selection: {path.name}")
    except (zipfile.BadZipFile, EOFError, RuntimeError) as error:
        raise ContractError(f"malformed zip archive: {path.name}") from error
    if matches != 1:
        raise ContractError(f"zip must contain exactly one required executable: {path.name}")


def discover_archives(root: pathlib.Path) -> dict[str, pathlib.Path]: