release: remove CLI vendor manifest embedding

.github/scripts/test_build_release_cli_archive.py

@@ -25,13 +25,18 @@
 
 ROOT = Path(__file__).resolve().parents[2]
 SCRIPT = ROOT / ".github/scripts/build_release_cli_archive.py"
+DOCTOR = ROOT / "crates/ethos-cli/src/cmd/doctor.rs"
 SPEC = importlib.util.spec_from_file_location("build_release_cli_archive", SCRIPT)
 assert SPEC is not None and SPEC.loader is not None
 MODULE = importlib.util.module_from_spec(SPEC)
 SPEC.loader.exec_module(MODULE)
 
 
 class BuildReleaseCliArchiveTests(unittest.TestCase):
+    def test_cli_does_not_embed_the_npm_vendor_manifest(self) -> None:
+        doctor = DOCTOR.read_text(encoding="utf-8")
+        self.assertNotIn('include_str!("../../../../packages/npm/ethos-pdf/vendor/manifest.json")', doctor)
+
     def test_two_archives_are_byte_identical_and_normalize_metadata(self) -> None:
         with tempfile.TemporaryDirectory() as temp:
             artifact_dir = Path(temp) / "ethos-linux-x64"

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- release: remove the CLI's compile-time npm vendor-manifest inclusion so the final CLI artifact
+  and npm vendor checksums are not self-referential.
 - boundary-exception: refresh the v0.4.0 npm vendor payload from the final byte-identical
   macOS arm64/Linux x64 CLI archive builds without rebuilding those publication artifacts.
 - ci: keep the verification Action checksum-pinned to the published v0.3.0 CLI while npm

crates/ethos-cli/src/cmd/doctor.rs

@@ -26,10 +26,9 @@ use crate::{write_output, DoctorArgs, Failure, INTERNAL_PDFIUM_LOAD_PROBE_ENV};
 const DOCTOR_PDFIUM_PROBE_TIMEOUT: Duration = Duration::from_secs(5);
 const PDFIUM_SETUP_GUIDANCE: &str =
     "PDFium setup command: scripts/fetch-pdfium.sh. Run it from an Ethos source checkout, apply the printed ETHOS_PDFIUM_LIBRARY_PATH export, then run ethos doctor --require-pdfium. The script verifies pinned archive and runtime sha256 values and never runs automatically. See docs/pdfium-manual-setup.md.";
-// Keep packaged-target reporting single-sourced with the npm vendor payload. If the packaging
-// layout moves, update this include rather than adding a second release target list.
-const NPM_VENDOR_MANIFEST: &str =
-    include_str!("../../../../packages/npm/ethos-pdf/vendor/manifest.json");
+// Keep this independent of the npm manifest: doctor is included in the CLI payload that the
+// manifest hashes, so embedding the manifest would make final release hashes self-referential.
+const NPM_CLI_TARGETS: &[&str] = &["darwin:arm64", "linux:x64"];
 
 pub(crate) fn doctor(args: DoctorArgs) -> Result<(), Failure> {
     let platform = current_platform();
@@ -133,20 +132,13 @@ fn current_platform() -> String {
 }
 
 fn packaged_target_status(platform: &str) -> String {
-    match manifest_targets() {
-        Some(targets) if targets.iter().any(|target| target == platform) => {
-            "supported by the approved npm vendor manifest".to_string()
-        }
-        Some(_) => "not listed in the approved npm vendor manifest".to_string(),
-        None => "could not read approved npm vendor manifest targets".to_string(),
+    if NPM_CLI_TARGETS.contains(&platform) {
+        "supported by the v0.4 npm CLI package".to_string()
+    } else {
+        "not listed in the v0.4 npm CLI package targets".to_string()
     }
 }
 
-fn manifest_targets() -> Option<Vec<String>> {
-    let value: serde_json::Value = serde_json::from_str(NPM_VENDOR_MANIFEST).ok()?;
-    Some(value.get("targets")?.as_object()?.keys().cloned().collect())
-}
-
 fn pdfium_error(message: String) -> Failure {
     Failure::Ethos(EthosError::new(ErrorCode::InternalError, message))
 }

crates/ethos-cli/tests/doctor.rs

@@ -98,7 +98,7 @@ fn doctor_warns_and_succeeds_when_pdfium_is_unset() {
     if cfg!(all(target_os = "macos", target_arch = "aarch64"))
         || cfg!(all(target_os = "linux", target_arch = "x86_64"))
     {
-        assert!(stdout.contains("packaged target: supported by the approved npm vendor manifest"));
+        assert!(stdout.contains("packaged target: supported by the v0.4 npm CLI package"));
     }
 }