mod artifact_class

module artifact_class

What kind of artifact a source URL denotes, and whether a checksum seeded from another ecosystem was computed over that same kind.

A version number does not identify bytes. GitHub serves two different tarballs for one tag: the archive it generates from the tree (/archive/refs/tags/v1.2.3.tar.gz) and whatever the project uploaded as a release asset (/releases/download/v1.2.3/thing-1.2.3.src.tar.xz). Spack and conda-forge frequently hash the first; EasyBuild frequently fetches the second. Copying a checksum across therefore yields a hash that is valid, well-formed, and wrong, and the build only finds out after the download.

Classifying both ends and refusing to carry a checksum between classes is what turns that into a build-time error instead of a silent one.

Functions

fn classify_foreign(url: Option<&str>, git: Option<&str>) -> ArtifactClass

Classify a foreign recipe’s source, which may name a checkout instead of a download.

fn classify_url(url: &str) -> ArtifactClass

Classify a download URL.

url may be a full URL or an EasyBuild source_urls entry with the filename appended separately; both are matched on path shape rather than on the filename, because the filename alone does not distinguish an archive from an asset.

fn declared_version(source_tree: &Path) -> Option<DeclaredVersion>

Read the version an upstream source tree declares, if any build system in it says so plainly.

Only unambiguous, single-line declarations are read. A version assembled from variables is left alone rather than guessed at, because a wrong answer here would rename a module.

fn verify_declared_version(recipe_version: &str, declared: Option<&DeclaredVersion>) -> Vec<SourceFinding>

Compare the version a recipe carries against the one its source declares.

This answers a question only a source tree can: a recipe pinned to a commit is free to call itself anything, and naming it after the last tag is the mistake that reads as correct.

fn verify_sources(source_urls: &[String], seeded: Option<&SeededChecksum>) -> Vec<SourceFinding>

Verify a recipe’s source URLs against a checksum seeded from elsewhere.

With no seed, the sources are still classified and anything unclassifiable is reported, because “we could not tell” is the state in which a wrong checksum survives.

Enums

enum ArtifactClass

The kind of artifact a source URL resolves to.

GitHubTagArchive

A tarball GitHub generates from a tag or branch: /archive/....

GitHubReleaseAsset

A file the project uploaded to a release: /releases/download/....

PyPiSdist

A source distribution from the Python package index.

SourceForge

A SourceForge file release.

GitCheckout

A checkout rather than a downloaded file. Has no artifact checksum.

Other

A recognised URL whose class carries no cross-ecosystem hazard.

Unknown

Nothing to classify: no URL, or one that parses as nothing useful.

Implementations

impl ArtifactClass

Functions

fn as_str(self) -> &'static str

The stable lowercase name used in output and messages.

fn checksum_transfers_to(self, other: ArtifactClass) -> bool

Whether a checksum may be carried from self to other.

Only equal classes are compatible. Unknown never certifies anything: an unclassified end means the question was not answered, which is not the same as answered yes.

fn conflicts_with(self, other: ArtifactClass) -> bool

Whether two different classes are known to serve different bytes for the same version. This is the mismatch worth failing a check over.

Traits implemented

impl fmt::Display for ArtifactClass

enum FindingLevel

How serious a source-verification finding is.

Error

The checksum is known to describe different bytes than the source.

Warning

The question could not be answered, so the checksum is unverified.

Structs and Unions

struct DeclaredVersion

The version an upstream build system declares for itself.

A recipe pinned to a commit takes its version from whoever writes the easyconfig, and the obvious choice, the last release tag, is often wrong: projects bump the in-tree version as soon as a release branches, so a snapshot taken after a tag declares something else. The module then claims a version its own binary does not report.

value: String

The version string as the build system writes it.

source: String

The file and construct it came from, for the message.

struct SeededChecksum

Where a checksum came from, when that is known.

origin: String

Ecosystem the value was copied from, for the message.

source_url: Option<String>

The URL that value was computed over.

git: Option<String>

A git remote, when the foreign recipe built from a checkout.

sha256: Option<String>

The value copied across, quoted back in a mismatch message.

struct SourceFinding

One statement about a source and the checksum attached to it.

level: FindingLevel

Whether this is a known mismatch or merely unverified.

message: String

What was found, in terms a reviewer can act on.

Implementations

impl SourceFinding

Traits implemented

impl fmt::Display for SourceFinding