Updates to hello world.

tools/check.py

@@ -3,11 +3,13 @@
 """Check the repository and the built Tentacle without running a reader."""
 
 import json
+import hashlib
 import os
 from pathlib import Path
 import select
 import subprocess
 import tomllib
+from urllib.parse import urlparse
 
 
 def require(condition, message):
@@ -27,7 +29,8 @@ def check_metadata(repoRoot):
             "Unsupported metadata format")
     require(repository["id"] == "storm.cthulhu-tentacles" and repository["name"],
             "Repository identity is missing")
-    require(catalog["tentacles"] == [{"id": "hello-world", "manifest": "hello-world/tentacle.toml"}],
+    require(len(catalog["tentacles"]) == 1 and catalog["tentacles"][0]["id"] == "hello-world"
+            and catalog["tentacles"][0]["manifest"] == "hello-world/tentacle.toml",
             "Catalog must list exactly Hello World")
     manifest = read_toml(repoRoot / catalog["tentacles"][0]["manifest"])
     require(manifest["format-version"] == 1 and manifest["id"] == "hello-world"
@@ -38,6 +41,23 @@ def check_metadata(repoRoot):
     require((repoRoot / "LICENSE").is_file() and (repoRoot / "hello-world/LICENSE").is_file(),
             "Repository and Tentacle licenses are required")
 
+    seen = set()
+    for release in catalog["tentacles"][0].get("releases", []):
+        key = (release["platform"], release["architecture"])
+        require(key not in seen and key[0] == "linux" and key[1] in ("amd64", "arm64"),
+                "Invalid or duplicate release target")
+        seen.add(key)
+        parsed = urlparse(release["url"])
+        require(parsed.scheme == "https" and parsed.hostname and not parsed.username
+                and not parsed.fragment, "Release URL must be HTTPS without credentials")
+        digest = release["sha256"]
+        require(len(digest) == 64 and all(character in "0123456789abcdef" for character in digest),
+                "Invalid SHA-256 digest")
+        artifactPath = repoRoot / "dist" / parsed.path.rsplit("/", 1)[-1]
+        if artifactPath.exists():
+            require(hashlib.sha256(artifactPath.read_bytes()).hexdigest() == digest,
+                    "Prepared package does not match its catalog digest")
+
 
 def check_registration(programPath):
     with subprocess.Popen([str(programPath)], stdin=subprocess.PIPE,