kevinveenbirkenbachandClaude Opus 5 66533e6b50 feat(packages): install a checksum-pinned vendor artefact where no repo exists ...

A vendor that ships a package file but runs no repository left the
registry nothing to resolve, so cursor declared an empty list on Debian
and RedHat and the role deployed while installing nothing.

The new 'download' source names the artefact directly and pins it by
digest: the URL alone would install whatever the vendor serves today.
get_url verifies before and after the transfer, the artefact is cached
root-owned so no other account can swap it in the window before the
install, and a closing package call fails loudly when the artefact
registered under a name other than the one declared.

Cursor's rpm carries no signature, which is why dnf runs with
disable_gpg_check; the digest is the integrity control. All 92 of its
requirements resolve against Fedora 44 and CentOS Stream 10 repodata.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-10-23 14:08:16 +02:00

..

__init__.py

…

test_facts.py

…

test_outcome.py

…

test_plan.py

feat(packages): install a checksum-pinned vendor artefact where no repo exists

2026-10-23 14:08:16 +02:00

test_registry.py

feat(packages): install a checksum-pinned vendor artefact where no repo exists

2026-10-23 14:08:16 +02:00