test: check the vendored MADR files against the upstream blob SHAs in their NOTICE #520

New issue

Closed

opened 2026-09-15 23:52:45 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-15 23:52:45 +00:00

Owner

What happens

internal/service/adr/madr/NOTICE records the upstream git blob SHA of each vendored MADR 4.0.0 file and says they are vendored byte for byte, because adr new and adr init write them out verbatim. Nothing checks it. A reformat, a stray edit, or a normalised newline would pass every gate.

Ask

A test that computes each vendored file's git blob hash and compares it with the SHA recorded in NOTICE. It fails with the file name and both hashes.

Acceptance

Changing one byte of a vendored template fails the test.
Updating to a new upstream version means updating NOTICE and the files together.

## What happens `internal/service/adr/madr/NOTICE` records the upstream git blob SHA of each vendored MADR 4.0.0 file and says they are vendored byte for byte, because `adr new` and `adr init` write them out verbatim. Nothing checks it. A reformat, a stray edit, or a normalised newline would pass every gate. ## Ask A test that computes each vendored file's git blob hash and compares it with the SHA recorded in `NOTICE`. It fails with the file name and both hashes. ## Acceptance - Changing one byte of a vendored template fails the test. - Updating to a new upstream version means updating `NOTICE` and the files together.

hexajon added the

testing

label

2026-09-15 23:52:45 +00:00

hexajon referenced this issue from a pull request that will close it,

2026-10-21 16:55:51 +00:00

test: check the vendored MADR files against the blob SHAs in NOTICE #864

hexajon referenced this issue from a commit

2026-10-21 16:55:51 +00:00

test: check the vendored MADR files against the blob SHAs in NOTICE

hexajon closed this issue

2026-10-21 16:55:53 +00:00