1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
|
/******************************************************************************
__ ____ __
/ / ___ ____ _/ __/_____________ _/ /__
/ / / _ \/ __ `/ /_/ ___/ ___/ __ `/ / _ \
/ /___/ __/ /_/ / __(__ ) /__/ /_/ / / __/
/_____/\___/\__,_/_/ /____/\___/\__,_/_/\___/
(C)opyright 2025, Leafscale, LLC - https://www.leafscale.com
Project: Zygaena
Filename: verify.reef
Authors: Chris Tusa <chris.tusa@leafscale.com>
License: <see LICENSE file included with this source code>
Description: Verify command - check installed package integrity
******************************************************************************/
module commands.verify
import sys.args
import io.file
import io.dir
import io.path
import core.str
import core.config
import core.database
import util.mtree
import util.checksum
import types
import util.color
import exitcodes as ec
import fs.stat
import fs.link
export
fn execute(opts: types.GlobalOptions): int
end export
fn execute(opts: types.GlobalOptions): int
let argc = args.count()
if argc <= opts.cmd_index + 1
print_usage()
return ec.EXIT_USAGE()
end if
// Load configuration and apply command-line overrides
let base_cfg = config.load()
let cfg = config.apply_overrides(base_cfg, opts.root, opts.prefix)
let root_path = config.get_root(cfg)
if opts.verbose and str.length(root_path) > 0
color.print_info("Using root: " + root_path)
end if
let pkg_name = args.get(opts.cmd_index + 1)
// Check if installed
if not check_installed(pkg_name, root_path)
color.print_error(pkg_name + " is not installed")
return ec.EXIT_PKG_NOT_FOUND()
end if
color.print_action("Verifying " + pkg_name + "...")
// Load manifest from database
let manifest_path = database.get_manifest_path(pkg_name)
if not file.fileExists(manifest_path)
color.print_error("No manifest found for " + pkg_name + " (legacy package without .MANIFEST)")
return ec.EXIT_PKG_INVALID()
end if
let manifest_content = file.readFile(manifest_path)
if str.length(manifest_content) == 0
color.print_error("Empty manifest for " + pkg_name)
return ec.EXIT_PKG_INVALID()
end if
mut entries: [mtree.ManifestEntry] = new [mtree.ManifestEntry](8192)
let entry_count = mtree.parse_manifest(manifest_content, entries, 8192)
if entry_count == 0
color.print_error("Failed to parse manifest for " + pkg_name)
return ec.EXIT_PKG_INVALID()
end if
// Determine actual root
let actual_root = get_actual_root(root_path)
// Verify each entry
mut missing_count = 0
mut checksum_fail_count = 0
mut mode_fail_count = 0
mut link_fail_count = 0
mut ok_count = 0
mut i = 0
while i < entry_count
let entry = entries[i]
let etype = mtree.entry_type(entry)
let epath = mtree.entry_path(entry)
mut rel_path = epath
if str.starts_with(epath, "./")
rel_path = str.substring(epath, 2, str.length(epath) - 2)
end if
let full_path = path.join_path(actual_root, rel_path)
if str.equals(etype, "dir")
if not dir.dir_exists(full_path)
color.print_warning("MISSING dir: " + rel_path)
missing_count = missing_count + 1
else
// Check mode
let expected_mode = mtree.entry_mode(entry)
let actual_mode = stat.file_mode(full_path)
// Compare lower 12 bits (permissions + setuid/setgid/sticky)
if (actual_mode % 4096) != (expected_mode % 4096)
if opts.verbose
color.print_warning("MODE " + rel_path + " (expected " + int_to_octal(expected_mode) + ", got " + int_to_octal(actual_mode) + ")")
else
color.print_warning("MODE " + rel_path)
end if
mode_fail_count = mode_fail_count + 1
else
ok_count = ok_count + 1
end if
end if
elif str.equals(etype, "file")
if not stat.exists(full_path)
color.print_warning("MISSING file: " + rel_path)
missing_count = missing_count + 1
else
mut file_ok = true
// Check sha256
let expected_sha = mtree.entry_sha256(entry)
if str.length(expected_sha) > 0
let actual_sha = checksum.sha256_file(full_path)
if not str.equals(actual_sha, expected_sha)
color.print_warning("CHECKSUM " + rel_path)
checksum_fail_count = checksum_fail_count + 1
file_ok = false
end if
end if
// Check mode
let expected_mode = mtree.entry_mode(entry)
let actual_mode = stat.file_mode(full_path)
if (actual_mode % 4096) != (expected_mode % 4096)
if opts.verbose
color.print_warning("MODE " + rel_path + " (expected " + int_to_octal(expected_mode) + ", got " + int_to_octal(actual_mode) + ")")
else
color.print_warning("MODE " + rel_path)
end if
mode_fail_count = mode_fail_count + 1
file_ok = false
end if
// Check ownership
let expected_uid = mtree.name_to_uid(mtree.entry_uname(entry))
let expected_gid = mtree.name_to_gid(mtree.entry_gname(entry))
let actual_uid = stat.file_uid(full_path)
let actual_gid = stat.file_gid(full_path)
if actual_uid != expected_uid or actual_gid != expected_gid
if opts.verbose
color.print_warning("OWNER " + rel_path + " (expected " + mtree.entry_uname(entry) + ":" + mtree.entry_gname(entry) + ")")
else
color.print_warning("OWNER " + rel_path)
end if
mode_fail_count = mode_fail_count + 1
file_ok = false
end if
if file_ok
ok_count = ok_count + 1
end if
end if
elif str.equals(etype, "link")
if not stat.is_symlink(full_path)
if not stat.exists(full_path)
color.print_warning("MISSING link: " + rel_path)
missing_count = missing_count + 1
else
color.print_warning("NOT A LINK " + rel_path)
link_fail_count = link_fail_count + 1
end if
else
let expected_target = mtree.entry_link(entry)
let actual_target = link.readlink(full_path)
if not str.equals(actual_target, expected_target)
if opts.verbose
color.print_warning("LINK " + rel_path + " -> " + actual_target + " (expected " + expected_target + ")")
else
color.print_warning("LINK TARGET " + rel_path)
end if
link_fail_count = link_fail_count + 1
else
ok_count = ok_count + 1
end if
end if
end if
i = i + 1
end while
// Summary
println("")
let total_issues = missing_count + checksum_fail_count + mode_fail_count + link_fail_count
if total_issues == 0
color.print_success(pkg_name + ": " + int_to_str(ok_count) + " entries verified, all OK")
return ec.EXIT_SUCCESS()
else
color.print_error(pkg_name + ": " + int_to_str(total_issues) + " issue(s) found")
if missing_count > 0
println(" Missing: " + int_to_str(missing_count))
end if
if checksum_fail_count > 0
println(" Checksum: " + int_to_str(checksum_fail_count))
end if
if mode_fail_count > 0
println(" Mode/Owner: " + int_to_str(mode_fail_count))
end if
if link_fail_count > 0
println(" Symlinks: " + int_to_str(link_fail_count))
end if
println(" OK: " + int_to_str(ok_count))
return ec.EXIT_PKG_CHECKSUM_MISMATCH()
end if
end execute
fn check_installed(name: string, root_path: string): bool
if str.length(root_path) > 0
return database.is_installed_rooted(name, root_path)
end if
return database.is_installed(name)
end check_installed
fn get_actual_root(root_path: string): string
if str.length(root_path) == 0
return "/"
end if
return root_path
end get_actual_root
proc print_usage()
println("Usage: coral verify <package>")
println("")
println("Verify integrity of an installed package against its manifest.")
println("")
println("Checks:")
println(" - Missing files, directories, and symlinks")
println(" - File checksum (sha256) mismatches")
println(" - Permission and ownership changes")
println(" - Broken or incorrect symlink targets")
println("")
println("Arguments:")
println(" <package> Name of installed package to verify")
println("")
println("Options:")
println(" -v, --verbose Show expected vs actual values for failures")
println("")
println("Examples:")
println(" coral verify vim")
println(" coral verify -v openssl")
end print_usage
// Helper: convert int to string
fn int_to_str(n: int): string
if n == 0
return "0"
end if
mut negative = false
mut value = n
if n < 0
negative = true
value = 0 - n
end if
mut result = ""
while value > 0
let digit = value % 10
result = str.concat(str.substring("0123456789", digit, 1), result)
value = value / 10
end while
if negative
result = str.concat("-", result)
end if
return result
end int_to_str
// Helper: convert int to octal string (for mode display)
fn int_to_octal(n: int): string
if n == 0
return "0"
end if
mut value = n % 4096
mut result = ""
while value > 0
let digit = value % 8
result = str.concat(str.substring("01234567", digit, 1), result)
value = value / 8
end while
return result
end int_to_octal
end module
|