[codeforester]

Summary

• reject duplicate, traversal, startup-hook, symlink, executable, and native-library archive members
• compare packaged base_cli files byte-for-byte with the reviewed source tree
• add malicious archive fixtures for duplicate members, traversal, and startup hooks
• preserve legitimate executable Python files under scripts/ in sdists

Security rationale

The release validator now fails closed before installation. It checks both wheel and sdist content and does not import or execute the artifact while validating it.

Validation

• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev pytest -q tests/test_validate_package_artifact.py
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev python -m build --wheel --sdist
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev python scripts/validate_package_artifact.py dist
• Ruff and git diff --check pass

Relates to #486.

[codeforester]

Robustness: this hardcodes the package path prefix as the literal string "lib/python/base_cli/" instead of deriving it from the IMPORT_NAME constant used everywhere else in this file. If IMPORT_NAME is ever changed, every other call site updates automatically via the constant, but this literal silently stops matching any real package file — relative.startswith(package_prefix) then never fires, and the new sha256 hash-verification control for sdist package files silently stops applying to anything, with no error raised.

[codeforester]

Cleanup (dead code / drift risk): expected_package_files() is now dead — main() only calls expected_package_hashes() and derives the files set from its keys — but expected_package_hashes() re-implements the identical rglob/filter traversal from scratch instead of reusing expected_package_files(). Both copies independently skip __pycache__/.pyc; a future edit to that filtering rule applied to only one copy would silently desync the file-allowlist from the hash-allowlist, and the unused function remains as a misleading signal that it's still part of the validation path.

[codeforester]

Implemented the review fixes in commit 703267a2.

• Wheel directory entries are skipped before executable-bit validation, so legitimate directory modes do not fail artifact validation.
• Wheel symbolic links are rejected explicitly using the Unix file-type bits, matching the sdist hard-link/symlink policy.
• Added regression tests for both behaviors.

[codeforester]

Addressed the remaining lint and maintainability feedback in commit dc117eb6.

• Replaced the UTF-8 string .encode() with a bytes literal (UP012).
• Removed the dead expected_package_files() traversal and made expected_package_hashes() the single source of truth.
• Derived the sdist package prefixes from IMPORT_NAME instead of duplicating base_cli literals.

The directory-entry and symlink regression tests remain in place.