From 6f3969f071639790c906fb6d20cc406d39355937 Mon Sep 17 00:00:00 2001
From: tmk241 <me@tmk241.dev>
Date: Mon, 10 Aug 2026 23:39:43 +0200
Subject: [PATCH] Verify public release artifacts and installer

---
 AGENTS.md              |  5 +++--
 test/installer_e2e.py  |  2 +-
 test/repository_e2e.sh | 40 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 3 deletions(-)
 create mode 100755 test/repository_e2e.sh

diff --git a/AGENTS.md b/AGENTS.md
index bcd3b51..b37f3d1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -25,8 +25,9 @@ Work is tracked in Gitea Issues for `tmk241/ink-releases`. Do not mirror issues
 
 ```sh
 bash -n install.sh
-python3 test/installer_e2e.py
-redgate lint < requirements.tsv
+uv run test/installer_e2e.py
+bash test/repository_e2e.sh
+awk '/^## / { component=$2; next } /^[0-9][0-9][0-9]\t/ { print component "/" $0 }' REQUIREMENTS.md | redgate lint -
 ```
 
 Final reports must include `REQUIREMENT IMPACT: IDs` or `REQUIREMENT IMPACT: none`.
diff --git a/test/installer_e2e.py b/test/installer_e2e.py
index 1cde449..15793a4 100755
--- a/test/installer_e2e.py
+++ b/test/installer_e2e.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-# req: installer/001, installer/002, installer/003, installer/004, installer/006 test
+# req: installer/001, installer/002, installer/003, installer/004, installer/005, installer/006 test
 import hashlib
 import http.server
 import os
diff --git a/test/repository_e2e.sh b/test/repository_e2e.sh
new file mode 100755
index 0000000..d0e87ef
--- /dev/null
+++ b/test/repository_e2e.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+set -eu
+# req: distribution/001, distribution/002, distribution/003, distribution/005, distribution/006, distribution/008 test
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+ink=$root/channels/main/ink
+set=$root/channels/main/toolset
+manifest=$set/ink-toolset-main-x86_64-linux-musl.manifest.tsv
+
+(cd "$ink" && sha256sum -c ink-SHA256SUMS >/dev/null)
+(cd "$set" && sha256sum -c ink-toolset-SHA256SUMS >/dev/null)
+file "$ink/ink-x86_64-linux-musl" | grep -q 'statically linked'
+
+awk -F '\t' '
+NR == 1 {
+    if ($0 != "source_repository\tsource_commit\texecutable\tset\ttarget\tbytes\tsha256\tasset") exit 1
+    next
+}
+$1 != "tmk241/ink-toolset" || $2 !~ /^[0-9a-f]{40}$/ || $5 != "x86_64-linux-musl" || $6 !~ /^[0-9]+$/ || $7 !~ /^[0-9a-f]{64}$/ || $8 == "" { exit 1 }
+END { if (NR < 2) exit 1 }
+' "$manifest"
+
+while IFS="$(printf '\t')" read -r source commit name group target bytes digest asset; do
+    [ "$source" = source_repository ] && continue
+    [ -f "$set/$asset" ]
+    [ "$(wc -c < "$set/$asset" | tr -d ' ')" = "$bytes" ]
+    [ "$(sha256sum "$set/$asset" | cut -d ' ' -f 1)" = "$digest" ]
+    file "$set/$asset" | grep -q 'statically linked'
+done < "$manifest"
+
+podman run --rm -v "$root/channels/main:/release:ro" ghcr.io/void-linux/void-musl:latest /bin/sh -c '
+set -eu
+/release/ink/ink-x86_64-linux-musl --help >/dev/null
+count=0
+for asset in /release/toolset/*-x86_64-linux-musl; do
+    "$asset" --help >/dev/null
+    count=$((count+1))
+done
+[ "$count" -gt 0 ]
+'