mgedmin/check-manifest

No problems traced to this repository code in these checks.

Reviewed as expected for a test run: a Python interpreter or package manager probed its own interpreter file under a system program folder; attempted writes that failed, so nothing was written.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• check-manifest reports when version-controlled files are missing from the sdist: Real input produced the expected result: missing from sdist

  Source: lists of files in version control and sdist do not match!

  Input: /tmp/cm-demo (notes.txt tracked in git but not in MANIFEST.in)

  Expected: nonzero exit with mismatch report

  Command: /tmp/cm-venv/bin/check-manifest /tmp/cm-demo

  Observed: missing from sdist: notes.txt

• --ignore skips files matching the patterns: Real input produced the expected result: lists of files in version control and sdist match

  Source: ignore files/directories matching these

  Input: --ignore notes.txt /tmp/cm-demo

  Expected: lists match, exit 0

  Command: /tmp/cm-venv/bin/check-manifest --ignore notes.txt /tmp/cm-demo

  Observed: lists of files in version control and sdist match

Examples

• Quick start: check the source tree in place: command completed successfully

  Source: README.rst Quick start

  Input: check-manifest on the checkout

  Expected: lists match

  Command: /tmp/cm-venv/bin/check-manifest -v

  Observed: listing source files under version control: 12 files and directories building an sdist: check_manifest-0.52.dev0.tar.gz: 12 files and directories copying source files to a temporary directory building a clean sdist: check_manifest-0.52.dev0.tar.gz: 12 files and directories lists of files in version control and sdist match

• Repository test suite (tox envlist uses pytest): command completed successfully

  Source: Makefile test target / tox.ini

  Input: pytest in checkout

  Expected: all tests pass

  Command: /tmp/cm-venv/bin/python -m pytest -p no:cacheprovider -q

  Observed: ........................................................................ [ 48%] ........ssssss....ssssssssssssss........................................ [ 96%] ..... [100%] 129 passed, 20 skipped in 42.37s

Local or hosted: local

Run check-manifest to compare files tracked in git against the sdist contents, reporting missing files and honoring --ignore

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README* 2>/dev/null | head -150
cd <guest-path> && sed -n 150,400p README.rst; ls -la .coldpass; cat tox.ini | head -30; ls /inputs 2>&1; echo $CDP_URL; cat setup.cfg | head -40
cd <guest-path> && git --version && git init -q && git remote add origin https://github.com/mgedmin/check-manifest && timeout 300 git fetch --depth 1 origin 5073ecd69f872358611507c3d09409b1b5df2971 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1; git log --oneline -1; git status --short | head
python3 -m venv /tmp/cm-venv 2>&1 | tail -3; /tmp/cm-venv/bin/pip install -q --upgrade pip 2>&1 | tail -3; /tmp/cm-venv/bin/pip install -q <guest-path> 2>&1 | tail -5; echo rc=$?; /tmp/cm-venv/bin/check-manifest --version
cd <guest-path> && /tmp/cm-venv/bin/check-manifest -v; echo rc=$?; git status --short | head
mkdir -p /tmp/cm-demo/mypkg && cd /tmp/cm-demo && printf 'from setuptools import setup\nsetup(name="mypkg", version="0.1", packages=["mypkg"])\n' > setup.py && printf '"""demo"""\n' > mypkg/__init__.py && printf 'hello\n' > notes.txt && git init -q && git add -A && git -c user.email=a@b -c user.name=demo commit -qm init && git ls-files
cd <guest-path> && /tmp/cm-venv/bin/check-manifest /tmp/cm-demo; echo rc=$?; /tmp/cm-venv/bin/check-manifest --ignore notes.txt /tmp/cm-demo; echo rc=$?
cd <guest-path> && cat Makefile | head -40; grep -n "test" setup.py | head; grep -n -A4 "extras_require" setup.py setup.cfg | head -20
/tmp/cm-venv/bin/pip install -q pytest wheel 2>&1 | tail -3; cd <guest-path> && timeout 900 /tmp/cm-venv/bin/python -m pytest -p no:cacheprovider -q 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/cm-venv/bin/check-manifest","--ignore","notes.txt","/tmp/cm-demo"],"cwd":"<guest-path>","expected_text":"lists of files in version control and sdist match"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"check-manifest reports when version-controlled files are missing from the sdist","source":"lists of files in version control and sdist do not match!","source_file":"README.rst","input":"/tmp/cm-demo (notes.txt tracked in git but not in MANIFEST.in)","expected":"nonzero exit with mismatch report","probe_kind":"cli","argv":["/tmp/cm-venv/bin/check-manifest","/tmp/cm-demo"],"expected_returncode":1,"expected_text":"missing from sdist","cwd":"<guest-path>"},
{"kind":"claim","claim":"--ignore skips files matching the patterns","source":"ignore files/directories matching these","source_file":"README.rst","input":"--ignore notes.txt /tmp/cm-demo","expected":"lists match, exit 0","probe_kind":"cli","argv":["/tmp/cm-venv/bin/check-manifest","--ignore","notes.txt","/tmp/cm-demo"],"expected_text":"lists of files in version control and sdist match","cwd":"<guest-path>"}]
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Quick start: check the source tree in place","source":"README.rst Quick start","input":"check-manifest on the checkout","expected":"lists match","argv":["/tmp/cm-venv/bin/check-manifest","-v"],"cwd":"<guest-path>","expected_text":"lists of files in version control and sdist match"},
{"kind":"example","claim":"Repository test suite (tox envlist uses pytest)","source":"Makefile test target / tox.ini","input":"pytest in checkout","expected":"all tests pass","argv":["/tmp/cm-venv/bin/python","-m","pytest","-p","no:cacheprovider","-q"],"cwd":"<guest-path>","expected_text":"129 passed"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"check-manifest is a one-shot CLI (README Quick start, Command-line reference). No scheduler, cron, loop, webhook, --once or --now entry point exists in check_manifest.py; the only recurring usage is the pre-commit hook in README Version control integration, which runs per commit and is not a product cycle.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -m json.tool $f.json >/dev/null && echo "$f ok"; done
ls <guest-path> 2>&1; cd <guest-path> && <env-var>=<guest-path> timeout 1200 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd <guest-path> && git status --short --ignored | head; ls -a
cd <guest-path> && rm -rf build check_manifest.egg-info __pycache__ && <env-var>=<guest-path> timeout 1200 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print(d['valid'], d['problems'], d['replay']['status'])"; git status --short --ignored
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run check-manifest to compare files tracked in git against the sdist contents, reporting missing files and honoring --ignore","operation_scope":"Local CLI from the pinned commit 5073ecd69f872358611507c3d09409b1b5df2971 (version 0.52.dev0), installed into /tmp/cm-venv with Python 3.12.3; requires a git repository (git 2.43.0). Tested on the checkout itself and on a demo project at /tmp/cm-demo with one tracked file missing from the sdist.","steps":["git init; git remote add origin https://github.com/mgedmin/check-manifest; git fetch --depth 1 origin 5073ecd69f872358611507c3d09409b1b5df2971; git reset --mixed FETCH_HEAD","python3 -m venv /tmp/cm-venv; /tmp/cm-venv/bin/pip install <guest-path>  (README Quick start uses pip install check-manifest; installed from the pinned source instead)","/tmp/cm-venv/bin/check-manifest -v  (README Quick start, run in checkout: lists match, rc 0)","/tmp/cm-venv/bin/check-manifest /tmp/cm-demo  (mismatch: missing from sdist notes.txt, rc 1)","/tmp/cm-venv/bin/check-manifest --ignore notes.txt /tmp/cm-demo  (lists match, rc 0)","/tmp/cm-venv/bin/python -m pytest -p no:cacheprovider -q  (Makefile test target equivalent: 129 passed, 20 skipped)"],"deviations":["README quick start says pip install check-manifest (PyPI); installed from the pinned local checkout instead so the tested code is the pinned commit.","Ran pytest directly in the venv instead of tox -p auto (tox not installed); same test suite via the test extra.","Probe/claim demo project /tmp/cm-demo is a constructed fixture (one tracked file missing from MANIFEST.in), created outside the checkout; no product source was edited.","checker path is <guest-path>; /inputs/coldpass-preflight.py does not exist in this guest."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -m json.tool report.json >/dev/null && echo report ok; ls -la <guest-path>