mirror of
https://github.com/kellymichels/zscripts-token-savers
synced 2026-10-07 07:18:18 +00:00
9d13b8ce72
CHECKSUMS.txt lists a SHA-256 for every top-level .ps1 and .cmd - the files a user actually executes. zchecksums verifies them; zchecksums -Update regenerates after an intentional edit. The manifest is sha256sum format, so 'sha256sum -c CHECKSUMS.txt' works on Linux/macOS/WSL as well as the PowerShell path on Windows. Hashes are identical on every platform because .gitattributes pins .ps1/.cmd to CRLF everywhere - that pin is now load-bearing, so it is commented as such. Beyond changed and missing files it also reports a script that is on disk but NOT in the manifest, so something added outside a commit still gets noticed. Exits non-zero on any of the three. Honest about its limits, in the header and the README: the manifest lives in the same repo as the code, so it is an integrity check rather than a signature. It catches a truncated clone, a forgotten local edit, or an unlisted file - not a compromised repo. CHECKSUMS.txt is pinned to LF: sha256sum treats a trailing CR as part of the filename and would report every entry as missing on Linux. tests/Checksums.Tests.ps1 keeps it from rotting - a stale manifest is worse than none, since it either cries wolf until people ignore it or quietly stops covering a new script. The tests assert the format, LF endings, sort order, full coverage of on-disk scripts, current hashes, and that zchecksums itself exits 1 on a tampered file (proved by appending a byte and restoring it). |
||
|---|---|---|
| .. | ||
| fixtures | ||
| ArgumentParsing.Tests.ps1 | ||
| Checksums.Tests.ps1 | ||
| NewProjectArchive.Tests.ps1 | ||
| ZHelpers.Tests.ps1 | ||