Record verified Component runtime snapshot and artifact checks

scripts/check-neitzellib-artifact.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Verify that the locally installed development runtime matches the tested artifact."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import sys
+
+ROOT = Path(__file__).resolve().parent.parent
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument("--repository", type=Path, default=Path.home() / ".m2/repository")
+args = parser.parse_args()
+manifest = json.loads((ROOT / "docs/runtime/neitzellib-baseline.json").read_text())
+errors = []
+for artifact in manifest["artifacts"]:
+    path = args.repository / artifact["repositoryPath"]
+    if not path.is_file():
+        errors.append(f"Missing: {path}")
+    elif hashlib.sha256(path.read_bytes()).hexdigest() != artifact["sha256"]:
+        errors.append(f"Different build: {path}")
+if errors:
+    print("\n".join(errors), file=sys.stderr)
+    sys.exit("Runtime identity mismatch. See docs/runtime/neitzellib-baseline.md; do not bypass this check merely because the version is 1.0-SNAPSHOT.")
+print(f"PASS {len(manifest['artifacts'])} runtime artifacts match tested source {manifest['sourceRevision']}; no corrected release version is claimed")