mirror of
https://github.com/kellymichels/zscripts-token-savers
synced 2026-10-07 07:18:18 +00:00
9d13b8ce72
CHECKSUMS.txt lists a SHA-256 for every top-level .ps1 and .cmd - the files a user actually executes. zchecksums verifies them; zchecksums -Update regenerates after an intentional edit. The manifest is sha256sum format, so 'sha256sum -c CHECKSUMS.txt' works on Linux/macOS/WSL as well as the PowerShell path on Windows. Hashes are identical on every platform because .gitattributes pins .ps1/.cmd to CRLF everywhere - that pin is now load-bearing, so it is commented as such. Beyond changed and missing files it also reports a script that is on disk but NOT in the manifest, so something added outside a commit still gets noticed. Exits non-zero on any of the three. Honest about its limits, in the header and the README: the manifest lives in the same repo as the code, so it is an integrity check rather than a signature. It catches a truncated clone, a forgotten local edit, or an unlisted file - not a compromised repo. CHECKSUMS.txt is pinned to LF: sha256sum treats a trailing CR as part of the filename and would report every entry as missing on Linux. tests/Checksums.Tests.ps1 keeps it from rotting - a stale manifest is worse than none, since it either cries wolf until people ignore it or quietly stops covering a new script. The tests assert the format, LF endings, sort order, full coverage of on-disk scripts, current hashes, and that zchecksums itself exits 1 on a tampered file (proved by appending a byte and restoring it).
10 lines
430 B
Plaintext
10 lines
430 B
Plaintext
# PowerShell/cmd are happiest with CRLF on Windows. The pin matters beyond
|
|
# convenience: it makes these files byte-identical on every platform, which is
|
|
# what lets CHECKSUMS.txt hold one hash per file rather than one per OS.
|
|
*.ps1 text eol=crlf
|
|
*.cmd text eol=crlf
|
|
|
|
# The checksum manifest must stay LF: `sha256sum -c` treats a trailing CR as
|
|
# part of the filename and reports every entry as missing.
|
|
CHECKSUMS.txt text eol=lf
|