Add registry-backed module package releases

2026-08-04 04:14:28 +02:00
parent 1a68565ba0
commit f7590a7b8b
25 changed files with 1887 additions and 5 deletions
@@ -1,6 +1,7 @@
 from __future__ import annotations

 import argparse
+import hashlib
 import importlib.util
 import json
 import os
@@ -298,12 +299,37 @@ class RuntimeDistributionBuildTests(unittest.TestCase):
            (root / "web.json").write_text(json.dumps(web_metadata))
            deployer = root / "govoplan-deploy.pyz"
            deployer.write_bytes(b"zipapp")
+            package_lock = root / "package-artifacts.lock.json"
+            package_lock_value = {
+                "schema_version": "1",
+                "release_version": "1.2.3",
+                "python": [
+                    {
+                        "name": "govoplan-core",
+                        "version": "1.2.3",
+                        "sha256": "8" * 64,
+                    }
+                ],
+                "webui": [],
+            }
+            package_lock_value["lock_sha256"] = hashlib.sha256(
+                json.dumps(
+                    package_lock_value,
+                    sort_keys=True,
+                    separators=(",", ":"),
+                ).encode("utf-8")
+            ).hexdigest()
+            package_lock.write_text(
+                json.dumps(package_lock_value) + "\n",
+                encoding="utf-8",
+            )
            args = argparse.Namespace(
                composition=root / "composition.json",
                api_metadata=root / "api.json",
                web_metadata=root / "web.json",
                deployer=deployer,
                deployer_url="https://downloads.example/govoplan-deploy.pyz",
+                package_lock=package_lock,
                artifact_base_url="https://downloads.example/runtime/v1.2.3",
                source_commit="f" * 40,
                version="1.2.3",
@@ -327,6 +353,10 @@ class RuntimeDistributionBuildTests(unittest.TestCase):
            )
            self.assertTrue((root / "evidence/api-sbom.cdx.json").is_file())
            self.assertTrue((root / "evidence/web-provenance.json").is_file())
+            self.assertEqual(
+                hashlib.sha256(package_lock.read_bytes()).hexdigest(),
+                descriptor["package_lock"]["sha256"],
+            )

    def test_rejects_incomplete_oci_index(self) -> None:
        with self.assertRaisesRegex(ValueError, "linux/amd64 and linux/arm64"):