Module: Kotoshu::Integrity
- Defined in:
- lib/kotoshu/integrity.rb,
lib/kotoshu/integrity/manifest.rb,
lib/kotoshu/integrity/net_http.rb,
lib/kotoshu/integrity/audit_log.rb,
lib/kotoshu/integrity/rotation_policy.rb
Overview
Integrity verification for downloaded resources.
Two cooperating pieces:
- Manifest — parsed view of a content repo's
manifest.json. Lookup by relative path yields the expected SHA-256 and size. - AuditLog — append-only JSON log at
$XDG_DATA_HOME/kotoshu/audit.logrecording every download's URL, size, computed SHA-256, manifest hash (when available), and status.
Caches call Manifest.verify_content! after each download. If the
manifest is absent (the upstream repo hasn't shipped one yet), the
caller logs the download with status "unverified" and proceeds —
graceful degradation. When a manifest IS present and the SHA-256
doesn't match, IntegrityError is raised and the corrupt
bytes are removed before they reach the cache.
Defined Under Namespace
Modules: NetHTTP Classes: AuditLog, Manifest, RotationPolicy