Verify locked dependencies during builds

[attahn]

Locked dependency integrity was only guaranteed during package resolution, while build, run, and check could consume dependency sources directly.

This verifies every reachable locked dependency before compilation, rejects stale or mismatched lock state, uses the exact verified roots, and includes mako.lock in incremental fingerprints. Transitive path dependencies now resolve relative to their declaring manifest, and locked builds fail closed if a verified root is unavailable.

Tests: cargo test --bin mako

Summary by CodeRabbit

• New Features

  • Added lockfile integrity verification across mako pkg install, mako build, mako run, and mako check, with builds failing closed on any mismatch, missing/unreadable transitive metadata, or malformed lock data.
  • Lockfile changes now invalidate type-check/build cache inputs, and locked dependency resolution prevents fallback to unverified content.
  • Locked dependency paths are computed deterministically to improve reproducibility.

• Documentation

  • Updated CLI and package/lockfile docs to reflect the shared verification behavior and the recommended recovery flow via mako pkg update.

[attahn]

@coderabbitai review

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ca77b870-8cbd-4f8f-a281-14a05de40c93

📥 Commits

Reviewing files that changed from the base of the PR and between 2a22625 and ff55723.

📒 Files selected for processing (3)

• docs/BUILD.md
• src/pkg.rs
• src/tooling.rs

---

📝 Walkthrough

Walkthrough

Locked dependency resolution now verifies lock metadata and dependency content before compilation, refuses unverified fallback paths, includes mako.lock in typecheck fingerprints, and documents verification behavior across package and build commands.

Changes

Lockfile integrity enforcement

Layer / File(s)	Summary
Deterministic locked path resolution src/pkg.rs	Path dependencies use manifest-origin-aware resolution and stable project-relative lock paths.
Reachability and content verification src/pkg.rs	Locked dependencies are checked against reachable manifests, lock metadata, on-disk paths, and content hashes, with tests covering tampering and stale entries.
Verified dependency merge enforcement src/tooling.rs	Dependency merging and import resolution use verified roots and snapshots throughout transitive traversal, rejecting unverified fallback paths.
Lockfile-aware typecheck fingerprints src/incremental.rs	Changes to mako.lock invalidate typecheck fingerprints.
Documented lockfile verification behavior docs/BUILD.md, docs/CLI.md, docs/book/src/ch10-packages.md, docs/howto/04-packages.md	Documentation describes verification timing, failure cases, and remediation commands.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Build
  participant merge_path_dependencies
  participant verified_dependency_roots
  participant mako.lock
  participant merge_path_deps_from_manifest
  Build->>merge_path_dependencies: merge manifest dependencies
  merge_path_dependencies->>verified_dependency_roots: verify project lock data
  verified_dependency_roots->>mako.lock: validate metadata and hashes
  verified_dependency_roots-->>merge_path_dependencies: return verified roots
  merge_path_dependencies->>merge_path_deps_from_manifest: pass verified roots
  merge_path_deps_from_manifest-->>Build: merge dependencies or reject unverified roots

Loading

Possibly related PRs

• loreste/mako#2: Implements related fail-closed mako.lock integrity verification in package management and dependency merge paths.

Suggested reviewers: loreste

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: build-time verification of locked dependencies.
Docstring Coverage	✅ Passed	Docstring coverage is 88.24% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/pkg.rs`:
- Around line 908-919: Update the dependency verification flow around
hash_path_dep and the verified_roots/verified_packages inserts so compilation
consumes the exact bytes validated by the hash check. Replace path-only
verification results with an immutable snapshot or retained verified
contents/digests, and update the src/tooling.rs manifest/source loading path to
parse or compile from that verified data rather than reopening mutable files.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 077c30e2-3ea3-4818-8102-3d3c4cbda028

📥 Commits

Reviewing files that changed from the base of the PR and between f56839a and 2a22625.

📒 Files selected for processing (7)

• docs/BUILD.md
• docs/CLI.md
• docs/book/src/ch10-packages.md
• docs/howto/04-packages.md
• src/incremental.rs
• src/pkg.rs
• src/tooling.rs