Make native checksum proof independent of a consumer bundle

Authored-By: Codex (GPT-6) <noreply@openai.com>

tools/private-modules/main_test.go

@@ -1,13 +1,13 @@
 package main
 
 import (
+	"archive/zip"
 	"bytes"
 	"encoding/json"
 	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strings"
 	"testing"
 )
 
@@ -74,47 +74,39 @@ func TestBundleRejectsStaleMissingModifiedAndUnexpectedArtifacts(t *testing.T) {
 }
 
 func TestNativeGoSumRejectsChangedModuleArtifact(t *testing.T) {
-	repository, err := filepath.Abs("..")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var m manifest
-	raw, err := os.ReadFile(filepath.Join(repository, bundleRoot, "manifest.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = json.Unmarshal(raw, &m); err != nil {
-		t.Fatal(err)
-	}
-	selected := m.Modules[0]
 	root := t.TempDir()
 	proxy := filepath.Join(root, "proxy")
-	for _, f := range selected.Files {
+	modulePath, version := "code.fritzlab.net/fixture/module", "v0.1.0"
-		b, err := os.ReadFile(filepath.Join(repository, bundleRoot, f.Path))
+	base := filepath.Join(proxy, modulePath, "@v", version)
-		if err != nil {
+	if err := os.MkdirAll(filepath.Dir(base), 0700); err != nil {
-			t.Fatal(err)
+		t.Fatal(err)
-		}
-		target := filepath.Join(proxy, f.Path)
-		if err = os.MkdirAll(filepath.Dir(target), 0700); err != nil {
-			t.Fatal(err)
-		}
-		if strings.HasSuffix(f.Path, ".mod") {
-			b = append(b, '\n')
-		}
-		if err = os.WriteFile(target, b, 0600); err != nil {
-			t.Fatal(err)
-		}
 	}
-	sum, err := os.ReadFile(filepath.Join(repository, "go.sum"))
+	mod := []byte("module " + modulePath + "\n\ngo 1.27.0\n")
+	os.WriteFile(base+".mod", mod, 0600)
+	os.WriteFile(base+".info", []byte(`{"Version":"v0.1.0","Time":"2026-01-01T00:00:00Z"}`), 0600)
+	var archive bytes.Buffer
+	zw := zip.NewWriter(&archive)
+	entry, err := zw.Create(modulePath + "@" + version + "/go.mod")
 	if err != nil {
 		t.Fatal(err)
 	}
-	os.WriteFile(filepath.Join(root, "go.sum"), sum, 0600)
+	entry.Write(mod)
-	os.WriteFile(filepath.Join(root, "go.mod"), []byte("module example.invalid/checksum\n\ngo 1.27.0\n"), 0600)
+	if err = zw.Close(); err != nil {
-	cmd := exec.Command("go", "mod", "download", selected.Path+"@"+selected.Version)
+		t.Fatal(err)
-	cmd.Dir = root
+	}
-	cmd.Env = append(os.Environ(), "GOMODCACHE="+filepath.Join(root, "cache"), "GOPROXY=file://"+proxy, "GONOPROXY=none", "GONOSUMDB="+privatePrefix, "GOSUMDB=off", "GOTOOLCHAIN=local", "GOFLAGS=", "GOWORK=off")
+	os.WriteFile(base+".zip", archive.Bytes(), 0600)
-	output, err := cmd.CombinedOutput()
+	os.WriteFile(filepath.Join(root, "go.mod"), []byte("module example.invalid/checksum\n\ngo 1.27.0\n\nrequire "+modulePath+" "+version+"\n"), 0600)
+	run := func(cache string) ([]byte, error) {
+		cmd := exec.Command("go", "mod", "download", modulePath+"@"+version)
+		cmd.Dir = root
+		cmd.Env = append(os.Environ(), "GO111MODULE=on", "GOMODCACHE="+filepath.Join(root, cache), "GOPROXY=file://"+proxy, "GONOPROXY=none", "GONOSUMDB="+privatePrefix, "GOSUMDB=off", "GOTOOLCHAIN=local", "GOFLAGS=", "GOWORK=off")
+		return cmd.CombinedOutput()
+	}
+	if output, err := run("original-cache"); err != nil {
+		t.Fatalf("native fixture admission: %v: %s", err, output)
+	}
+	os.WriteFile(base+".mod", append(mod, '\n'), 0600)
+	output, err := run("fresh-cache")
 	if err == nil || !bytes.Contains(output, []byte("checksum mismatch")) {
 		t.Fatalf("native module checksum guard failed: %v: %s", err, output)
 	}