[codeforester]

Summary

• reject duplicate, traversal, startup-hook, symlink, executable, and native-library archive members
• compare packaged base_cli files byte-for-byte with the reviewed source tree
• add malicious archive fixtures for duplicate members, traversal, and startup hooks
• preserve legitimate executable Python files under scripts/ in sdists

Security rationale

The release validator now fails closed before installation. It checks both wheel and sdist content and does not import or execute the artifact while validating it.

Validation

• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev pytest -q tests/test_validate_package_artifact.py
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev python -m build --wheel --sdist
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev python scripts/validate_package_artifact.py dist
• Ruff and git diff --check pass

Relates to #486.

[codeforester]

Implemented the review fixes in commit 703267a2.

• Wheel directory entries are skipped before executable-bit validation, so legitimate directory modes do not fail artifact validation.
• Wheel symbolic links are rejected explicitly using the Unix file-type bits, matching the sdist hard-link/symlink policy.
• Added regression tests for both behaviors.

[codeforester]

Addressed the remaining lint and maintainability feedback in commit dc117eb6.

• Replaced the UTF-8 string .encode() with a bytes literal (UP012).
• Removed the dead expected_package_files() traversal and made expected_package_hashes() the single source of truth.
• Derived the sdist package prefixes from IMPORT_NAME instead of duplicating base_cli literals.

The directory-entry and symlink regression tests remain in place.