Harden registry package verification

[attahn]

Hardens registry digest verification across fallback, cache, and build paths. It versions new digests while preserving legacy seals, and rejects reserved or symlinked publish inputs. Tests: cargo test --bin mako passed.

[attahn]

@coderabbitai[bot] please review.

[coderabbitai]

Warning

Review limit reached

@attahn, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 16 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: eaa7dccc-0a6d-4cfa-8e43-3b6ff0aa3f4b

📥 Commits

Reviewing files that changed from the base of the PR and between 2ea1df0 and 8d02d8d.

📒 Files selected for processing (5)

• docs/CLI.md
• docs/book/src/ch10-packages.md
• src/incremental.rs
• src/pkg.rs
• src/tooling.rs

📝 Walkthrough

Walkthrough

Registry packages now use staged PACKAGE.sha256 digests with legacy and v2 verification, safer publication and resolution flows, tamper detection, and symlink rejection. Dependency fingerprint collection also propagates dependency-resolution errors instead of silently ignoring them.

Changes

Registry package integrity

Layer / File(s)	Summary
Digest format and publication staging src/pkg.rs, docs/CLI.md	Package digests support legacy and v2: formats, exclude defined metadata paths, reject unsafe entries, reserve the top-level digest name, and are written during staging.
Verified registry resolution and installation src/pkg.rs, src/tooling.rs, docs/book/src/ch10-packages.md	Registry lookup is separated from digest verification, and project-local or cached packages are verified before resolution and installation.
Integrity and publication validation src/pkg.rs	Tests cover digest contents, malformed and mismatched records, cache tampering, reserved paths, and symlinked manifests.

Fingerprint dependency errors

Layer / File(s)	Summary
Fallible dependency fingerprint collection src/incremental.rs	Dependency collection and typecheck fingerprinting now return errors from dependency root resolution while tolerating unreadable manifests.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Publisher
  participant LocalRegistry
  participant Resolver
  participant DigestVerifier
  Publisher->>Publisher: stage package and write PACKAGE.sha256
  Publisher->>LocalRegistry: finalize publication
  Resolver->>LocalRegistry: locate matching package
  Resolver->>DigestVerifier: verify PACKAGE.sha256
  DigestVerifier-->>Resolver: verified package or digest mismatch

Loading

Possibly related PRs

• loreste/mako#2: Both changes extend SHA-256 integrity checking in src/pkg.rs, including v2 digest handling.
• loreste/mako#4: Both changes modify local registry publication and resolution behavior in src/pkg.rs.

Suggested reviewers: loreste

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: strengthening registry package verification and digest handling.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

@attahn I’ll review the registry digest verification and publication-validation changes in #5.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[attahn]

CI matches the current main baseline: the same six jobs fail and the same five jobs pass in both runs. The failures are in existing runtime tests and cross-compilation paths outside this PR; cargo test --bin mako passes for the registry changes. Baseline run: https://github.com/loreste/mako/actions/runs/29670786536