"""Strict local package inventory/hash check. Integrity, not a digital author signature."""
import hashlib,json
from pathlib import Path
ROOT=Path(__file__).resolve().parents[1]
def verify(root=ROOT):
 manifest=json.loads((root/'SHA256SUMS.json').read_text());seen=set()
 for row in manifest['files']:
  relative=Path(row['path'])
  if relative.is_absolute()or'..'in relative.parts or str(relative)in seen:raise ValueError('Unsafe or duplicate member')
  seen.add(str(relative));body=(root/relative).read_bytes()
  if len(body)!=row['bytes']or hashlib.sha256(body).hexdigest()!=row['sha256']:raise ValueError('Package member changed: '+str(relative))
 if not manifest['defaultHttpBytes']==0 or manifest['originalObservationsIncluded']:raise ValueError('Unexpected public scope')
 return len(seen)
if __name__=='__main__':print('PASS: exact own package inventory, '+str(verify())+' hashed members; no content-signature claim')