feat(release): build verified full-registry catalog candidates

tools/release/govoplan_release/artifact_identity.py

@@ -14,6 +14,8 @@ import re
 import stat
 import zipfile
 
+from .registry_reference import registry_artifact_conflicts, registry_entry_source
+
 
 WHEEL_PAYLOAD_ALGORITHM = "govoplan-wheel-declared-payload-v1"
 INSTALLED_PAYLOAD_ALGORITHM = "govoplan-installed-record-payload-v1"
@@ -185,10 +187,23 @@ def selected_artifact_identity_issues(payload: object) -> tuple[str, ...]:
     modules = payload.get("modules")
     if isinstance(modules, list):
         entries.extend(modules)
+    conflicts = registry_artifact_conflicts(entries)
+    if conflicts:
+        return conflicts
     package_by_repo: dict[str, tuple[str, str]] = {}
+    registry_artifacts: dict[str, dict[str, object]] = {}
     for entry in entries:
         if not isinstance(entry, dict):
             continue
+        try:
+            registry_source = registry_entry_source(entry)
+        except ValueError as exc:
+            return (str(exc),)
+        if registry_source is not None:
+            package = str(entry["python_package"])
+            package_by_repo[registry_source.repository] = (package, registry_source.version)
+            registry_artifacts[package] = entry["artifact_integrity"]["python"]
+            continue
         python_ref = entry.get("python_ref")
         match = _PYTHON_REF.search(python_ref) if isinstance(python_ref, str) else None
         package_name = entry.get("python_package")
@@ -219,6 +234,14 @@ def selected_artifact_identity_issues(payload: object) -> tuple[str, ...]:
     issues: list[str] = []
     if malformed_artifacts:
         issues.append("release.artifacts contains malformed or duplicate identities")
+    for package, registry_artifact in registry_artifacts.items():
+        artifact = artifacts_by_package.get(package)
+        if artifact is None or (
+            artifact.get("archive_sha256") != registry_artifact.get("sha256")
+            or artifact.get("archive_size") != registry_artifact.get("size")
+            or artifact.get("package_version") != registry_artifact["registry_identity"].rsplit("@", 1)[-1]
+        ):
+            issues.append(f"registry artifact {package} has no matching inspected wheel byte identity")
     seen_repos: set[str] = set()
     for unit in selected_units:
         if not isinstance(unit, dict):