Based on public Shuyang Home v1.2.2 source, test fixtures and release records. Existing behavior, recorded checks and proposed tests are distinguished; this update is a source review and write-up.
Give the version a single source
The root VERSION coordinates version values across the backend, Web app, mobile app and lockfiles. Editing only a README or Git tag can leave mismatched programs and archives. Version consistency belongs before the build.
A historical package must be checked against its own VERSION, not the current repository version. verify-release.py accepts an explicit package name and uses that package’s version to locate its JAR.
Compare the file set before comparing contents
Checking only the digests listed in a manifest can miss extra files. The current verifier first requires the actual file set to equal the manifest entries plus SHA256SUMS itself, then computes each digest.
The script also excludes selected runtime directories, key-file suffixes and test content that should not ship. These rules need maintenance as the deployment changes; they are not a general scanner for every possible secret.
# Simplified file-set invariant
expected = set(manifest) | {'SHA256SUMS'}
if set(actual_files) != expected:
raise ValueError('Missing or unlisted files')
# Digest checks follow only after the file set matches.Check the ZIP as well as the staging directory
After checking the staging directory, the verifier opens the ZIP and compares paths and file bytes against it. This catches a stale or mismatched archive even when the directory itself is correct.
The backend JAR is inspected for expected membership classes and unwanted legacy or test classes. These are selected content constraints; behavior still depends on the relevant tests.
How to recheck an existing local release
Run these commands at the repository root. The last command requires release/shuyang-home-v1.2.1 and its ZIP to have been generated locally using the packaging guide. A source checkout or GitHub source archive is not that delivery directory.
python scripts/version.py check
python scripts/verify-release.py shuyang-home-v1.2.1The recorded verification of 140 files describes the local v1.2.1 release package. The v1.2.2 file-mode repair does not constitute another full packaging acceptance run.
Digests are one part of the evidence
Matching digests help establish content identity. They do not prove the software is correct or the report author is trustworthy. Keep the test report, revision, environment and artifact digests together, with separate release authorization.
The current script targets trusted locally generated packages and expresses checks with assert; do not run it with Python -O. Handling externally supplied archives would require duplicate-path checks, resource limits and explicit error reporting.
Sources & further reading
Compiled from code and documents, with AI-assisted drafting and translation. Examples and proposed checks are learning material; only linked evidence establishes what was run.