@runeditrun/rer 0.0.0-stage → 0.1.0

package/scripts/publish-check/command_source_quotes.py

@@ -0,0 +1,120 @@
+"""Recognize Python literal openers by syntax, without evaluating source."""
+import ast
+import io
+import re
+import textwrap
+import tokenize
+import warnings
+from command_shell_quotes import output_quotes
+
+PREFIX = re.compile(r'''(?i)(?:br|rb|fr|rf|[bruf])(?=["'])''')
+PREFIX_BEFORE = re.compile(r'(?i)(?<!\w)(?:br|rb|fr|rf|[bruf])$')
+STRING_TOKENS = {tokenize.STRING, getattr(tokenize, 'FSTRING_START', tokenize.STRING)}
+
+
+def parsed_quotes(source):
+    """Return lexical quote offsets only when their containing source parses.
+
+    Tokenization alone accepts a possessive as a string token even in invalid
+    prose. Parsing alone accepts comments that contain possessives. Both are
+    needed before an apostrophe may truncate a later shell command.
+    """
+    code = textwrap.dedent(source)
+    try:
+        # Inspected text must never be emitted through parser warnings.
+        with warnings.catch_warnings():
+            warnings.simplefilter('ignore')
+            ast.parse(code)
+        tokens = list(tokenize.generate_tokens(io.StringIO(code).readline))
+    except (SyntaxError, ValueError, tokenize.TokenError, RecursionError):
+        return None
+    original_lines = source.splitlines(keepends=True)
+    code_lines = code.splitlines(keepends=True)
+    offsets, offset = [], 0
+    for line in original_lines:
+        offsets.append(offset)
+        offset += len(line)
+    quotes = set()
+    for token in tokens:
+        prefix = PREFIX.match(token.string) if token.type in STRING_TOKENS else None
+        if prefix:
+            row, column = token.start
+            removed = len(original_lines[row - 1]) - len(code_lines[row - 1])
+            quotes.add(offsets[row - 1] + removed + column + prefix.end())
+    return quotes
+
+
+def literal_quotes(source):
+    quotes = parsed_quotes(source)
+    complete = quotes is not None
+    quotes = quotes if complete else set()
+    quotes.update(output_quotes(source))
+    # A complete statement still has its own grammar when neighboring prose
+    # or a later statement is malformed. Split at Python token boundaries,
+    # never at punctuation inside a string, comment or open expression.
+    offsets = [0]
+    for line in source.splitlines(keepends=True):
+        offsets.append(offsets[-1] + len(line))
+    start, depth = 0, 0
+    try:
+        for token in tokenize.generate_tokens(io.StringIO(source).readline):
+            if token.type == tokenize.COMMENT:
+                # Comments may document source code. Validate the entire
+                # explicitly marked body, so prose possessives remain prose.
+                body_quotes = parsed_quotes(token.string[1:])
+                body_quotes = (body_quotes or set()) | output_quotes(token.string[1:])
+                if body_quotes:
+                    row, column = token.start
+                    quotes.update(offsets[row - 1] + column + 1 + index for index in body_quotes)
+            if token.type == tokenize.OP:
+                if token.string in '([{':
+                    depth += 1
+                elif token.string in ')]}':
+                    depth -= 1
+            if not complete and (token.type == tokenize.NEWLINE or (token.string == ';' and depth == 0)):
+                row, column = token.end
+                end = min(len(source), offsets[row - 1] + column)
+                statement_quotes = parsed_quotes(source[start:end])
+                if statement_quotes is not None:
+                    quotes.update(start + index for index in statement_quotes)
+                start = end
+    except (SyntaxError, ValueError, tokenize.TokenError, RecursionError):
+        pass
+    for comment in re.finditer(r'(?m)^[ \t]*(?://|/\*)([^\n]*)', source):
+        body = comment[1]
+        if comment[0].lstrip().startswith('/*'):
+            close = body.find('*/')
+            if close < 0:
+                continue
+            body = body[:close]
+        body_quotes = parsed_quotes(body)
+        body_quotes = (body_quotes or set()) | output_quotes(body)
+        if body_quotes:
+            quotes.update(comment.start(1) + index for index in body_quotes)
+    return quotes
+
+
+class SourceQuotes:
+    def __init__(self, text):
+        self.text = text
+        self.regions = {}
+
+    def region(self, start, end):
+        key = (start, end)
+        if key not in self.regions:
+            self.regions[key] = literal_quotes(self.text[start:end])
+        return self.regions[key]
+
+    def contains(self, index, start=0, end=None):
+        if not PREFIX_BEFORE.search(self.text, max(0, index - 2), index):
+            return False
+        end = len(self.text) if end is None else end
+        quotes = self.region(start, end)
+        if index - start in quotes:
+            return True
+        # An earlier malformed token can prevent document tokenization from
+        # reaching a later source line. Only retry the whole physical line.
+        start = max(start, self.text.rfind('\n', start, index) + 1)
+        line_end = self.text.find('\n', index, end)
+        end = end if line_end < 0 else line_end
+        return index - start in self.region(start, end)

package/scripts/publish-check/content_identities.py

@@ -0,0 +1,250 @@
+"""Classify module Git pins and prove Source keys at specific JSON locations.
+
+This is classification, not Source authoring validation. A stale lock still
+fails the authoring check. Missing original preimages remain ordinary findings.
+"""
+import base64
+import hashlib
+import re
+import json
+from pathlib import Path
+import subprocess
+from json_identity import Document, HEX
+from provenance_pins import module_pins
+from copy_identities import copy_pointers
+
+ARCHIVE = re.compile(r'\.edition/sources/([a-f0-9]{64})\.json\Z')
+
+
+def candidate(path):
+    return path in ('edition.json', 'sources.lock.json', 'base-copies.json', 'base/PROVENANCE.json') or bool(ARCHIVE.fullmatch(path))
+
+
+def safe_path(value):
+    return (isinstance(value, str) and value and not re.search(r'[\\\x00-\x1f\x7f]', value)
+            and all(part not in ('', '.', '..', '.git') for part in value.split('/')))
+
+
+def valid_files(files):
+    if not isinstance(files, dict) or not files:
+        return False
+    for name, file in files.items():
+        if (not safe_path(name) or not isinstance(file, dict) or not isinstance(file.get('data'), str)
+                or type(file.get('executable')) is not bool):
+            return False
+        try:
+            if base64.b64encode(base64.b64decode(file['data'], validate=True)).decode() != file['data']:
+                return False
+        except ValueError:
+            return False
+    return True
+
+
+def same_json(left, right):
+    # Python equates booleans and numbers; Source JSON identities do not.
+    return json.dumps(left, sort_keys=True) == json.dumps(right, sort_keys=True)
+
+
+class ContentIdentities:
+    def __init__(self, files, read_regular=None):
+        self.documents, self.allowed, self.archives, self.hashes = {}, {}, {}, {}
+        for path, data in files.items():
+            if candidate(path):
+                try:
+                    self.documents[path] = Document(data)
+                except (ValueError, TypeError, IndexError, RecursionError, UnicodeError):
+                    pass
+        if not self.documents:
+            return
+        for path, document in self.documents.items():
+            for pointer in module_pins(path, document.value):
+                self.allow(path, pointer)
+            if path in ('base-copies.json', 'base/PROVENANCE.json') and read_regular is not None:
+                for pointer in copy_pointers(document.value, read_regular):
+                    self.allow(path, pointer)
+        recipe = self.document('edition.json')
+        origins = [self.origin(recipe.get('parent'), True)]
+        components = recipe.get('components', [])
+        if isinstance(components, list):
+            for component in components:
+                source = component.get('source') if isinstance(component, dict) else None
+                if isinstance(source, dict):
+                    origins.append(self.origin(source if source.get('kind') == 'git' else source.get('origin')))
+        values = [recipe, *(v for v in origins if v is not None)]
+        for path, document in self.documents.items():
+            saved = document.value
+            if ARCHIVE.fullmatch(path) and isinstance(saved, dict):
+                values.extend([saved, saved.get('origin'), saved.get('files')])
+        self.hashes = {}
+        if values:
+            try:
+                result = subprocess.run(['node', str(Path(__file__).with_name('source_hashes.mjs'))],
+                                        input=json.dumps(values).encode(), capture_output=True, timeout=60, check=True)
+                hashes = json.loads(result.stdout)
+                if len(hashes) != len(values) or not all(isinstance(h, str) and HEX.fullmatch(h) for h in hashes):
+                    return
+                self.hashes = {json.dumps(v): h for v, h in zip(values, hashes)}
+            except (OSError, ValueError, subprocess.SubprocessError):
+                return
+        # Authoring pins hash(json(saved)); a raw-byte pin alone cannot prove a
+        # differently encoded retained archive, even when its fields agree.
+        for path, document in self.documents.items():
+            saved, match = document.value, ARCHIVE.fullmatch(path)
+            if (match and isinstance(saved, dict) and saved.get('key') == match[1]
+                    and isinstance(saved.get('origin'), dict) and saved['origin']
+                    and valid_files(saved.get('files'))
+                    and isinstance(saved.get('dependencies', []), list)
+                    and saved['key'] == self.digest(saved['origin'])
+                    and saved.get('digest') == self.digest(saved['files'])
+                    and hashlib.sha256(document.data).hexdigest() == self.digest(saved)):
+                self.archives[saved['key']] = (saved, hashlib.sha256(document.data).hexdigest())
+        self.references()
+
+    def digest(self, value):
+        return self.hashes.get(json.dumps(value))
+
+    def allow(self, path, pointer):
+        self.allowed.setdefault(path, set()).add(pointer)
+
+    def document(self, path):
+        doc = self.documents.get(path)
+        return doc.value if doc and isinstance(doc.value, dict) else {}
+
+    def pin(self, pin, key):
+        if not isinstance(pin, dict) or not isinstance(key, str) or key not in self.archives:
+            return False
+        archive, raw_sha = self.archives[key]
+        return (pin.get('key') == key and pin.get('digest') == archive['digest']
+                and pin.get('sha256') == raw_sha)
+
+    def reference(self, ref, parent=False):
+        if not isinstance(ref, dict):
+            return None
+        if not self.valid_selection(ref):
+            return None
+        selection = dict(path=ref.get('path') or '.', paths=ref.get('paths') or None,
+                         excludeSnapshots=True if parent else bool(ref.get('excludeSnapshots')))
+        projection = ref.get('projection')
+        if isinstance(projection, dict) and set(projection) == {'key', 'sha256'}:
+            key = projection['key']
+            if not isinstance(key, str) or key not in self.archives:
+                return None
+            saved, raw_sha = self.archives[key]
+            if (projection['sha256'] == raw_sha and same_json(saved['origin'].get('selection'), selection)):
+                return key
+            return None
+        origin = self.origin(ref, parent)
+        key = self.digest(origin)
+        if key in self.archives and same_json(self.archives[key][0]['origin'], origin):
+            return key
+        return None
+
+    @staticmethod
+    def valid_selection(ref):
+        return (ref.get('path', '.') == '.' or safe_path(ref.get('path'))) and (
+            ref.get('paths') is None or isinstance(ref['paths'], list) and bool(ref['paths'])
+            and all(safe_path(p) for p in ref['paths'])) and (
+            'excludeSnapshots' not in ref or type(ref['excludeSnapshots']) is bool)
+
+    @staticmethod
+    def origin(ref, parent=False):
+        if not isinstance(ref, dict) or not ContentIdentities.valid_selection(ref):
+            return None
+        projection = ref.get('projection')
+        if (not isinstance(ref.get('repository'), str) or not ref['repository']
+                or ref['repository'].startswith('-')):
+            return None
+        if 'projection' in ref:
+            if ('revision' in ref or not isinstance(projection, dict) or set(projection) != {'schemaVersion', 'originalSha256', 'recipeSha256'}
+                    or type(projection['schemaVersion']) is not int or projection['schemaVersion'] != 1
+                    or not all(isinstance(projection[k], str) and HEX.fullmatch(projection[k])
+                               for k in ('originalSha256', 'recipeSha256'))):
+                return None
+            identity = dict(projection=projection)
+        elif isinstance(ref.get('revision'), str) and re.fullmatch(r'[a-f0-9]{40}', ref['revision']):
+            identity = dict(revision=ref['revision'])
+        else:
+            return None
+        return dict(repository=ref['repository'], **identity, path=ref.get('path') or '.',
+                    paths=ref.get('paths') or None,
+                    excludeSnapshots=True if parent else bool(ref.get('excludeSnapshots')))
+
+    def dependency_locations(self, key):
+        # Stage the entire selected closure before granting any of its locations.
+        # An unresolved later edge must not leave the root or earlier edges allowed.
+        pending, visited, locations = [key], set(), []
+        while pending:
+            key = pending.pop()
+            if key in visited:
+                continue
+            visited.add(key)
+            saved, _ = self.archives[key]
+            path = '.edition/sources/' + key + '.json'
+            locations.append((path, ('key',)))
+            for i, pin in enumerate(saved.get('dependencies', [])):
+                if not isinstance(pin, dict) or not self.pin(pin, pin.get('key')):
+                    return None
+                locations.append((path, ('dependencies', i, 'key')))
+                pending.append(pin['key'])
+        return locations
+
+    def references(self):
+        recipe = self.document('edition.json')
+        lock = self.document('sources.lock.json')
+        if type(recipe.get('schemaVersion')) is not int or recipe['schemaVersion'] != 1 or not isinstance(recipe.get('components'), list):
+            return
+        components = lock.get('components')
+        locked = (type(lock.get('schemaVersion')) is int and lock['schemaVersion'] == 1
+                  and isinstance(recipe.get('id'), str) and lock.get('edition') == recipe['id']
+                  and lock.get('manifest') == self.digest(recipe) and isinstance(components, list))
+        if not locked:
+            return
+        def identifiers(entries):
+            ids = [entry.get('id') for entry in entries if isinstance(entry, dict)]
+            return (len(ids) == len(entries) and all(isinstance(i, str) and i for i in ids)
+                    and len(set(ids)) == len(ids))
+        if not identifiers(recipe['components']) or not identifiers(components):
+            return
+        by_id = {c['id']: c for c in components}
+        if (len(components) != len(recipe['components']) or any(
+                c['id'] not in by_id or not same_json(c.get('source'), by_id[c['id']].get('source'))
+                for c in recipe['components'])):
+            return
+        selected = []
+        key = self.reference(recipe.get('parent'), parent=True)
+        if key and locked and self.pin(lock.get('parent'), key):
+            selected.append((key, [
+                ('edition.json', ('parent', 'projection', 'key')),
+                ('sources.lock.json', ('parent', 'key')),
+            ]))
+        for index, component in enumerate(recipe['components']):
+            if not isinstance(component, dict):
+                continue
+            source = component.get('source')
+            if not isinstance(source, dict):
+                continue
+            suffix = () if source.get('kind') == 'git' else ('origin',) if source.get('kind') == 'local' else None
+            if suffix is None:
+                continue
+            key = self.reference(source if not suffix else source.get('origin'))
+            if not key:
+                continue
+            for i, entry in enumerate(components):
+                if (isinstance(entry, dict) and entry.get('id') == component.get('id')
+                        and same_json(entry.get('source'), source) and self.pin(entry.get('baseline'), key)):
+                    selected.append((key, [
+                        ('edition.json', ('components', index, 'source', *suffix, 'projection', 'key')),
+                        ('sources.lock.json', ('components', i, 'baseline', 'key')),
+                        ('sources.lock.json', ('components', i, 'source', *suffix, 'projection', 'key')),
+                    ]))
+        # Validate each selection independently: unselected archives and unrelated
+        # coherent selections cannot invalidate this graph's proof.
+        for key, locations in selected:
+            dependencies = self.dependency_locations(key)
+            if dependencies is not None:
+                for path, pointer in locations + dependencies:
+                    self.allow(path, pointer)
+
+    def matches(self, path, hit):
+        document = self.documents.get(path)
+        return bool(document and document.matches(hit, self.allowed.get(path, ())))

package/scripts/publish-check/copy_identities.py

@@ -0,0 +1,41 @@
+"""Prove copy-inventory digests against regular files in the scanned tree."""
+import hashlib
+import re
+from json_identity import HEX, GIT_REVISION
+
+
+def relative_path(value):
+    return (isinstance(value, str) and value and not value.startswith('/')
+            and not re.search(r'[\\\x00-\x1f\x7f]', value)
+            and all(part not in ('', '.', '..', '.git') for part in value.split('/')))
+
+
+def copy_pointers(document, read_regular):
+    if (not isinstance(document, dict) or type(document.get('schemaVersion')) is not int
+            or document['schemaVersion'] != 1 or not isinstance(document.get('copies'), list)):
+        return set()
+    allowed = set()
+    for index, copy in enumerate(document['copies']):
+        if (not isinstance(copy, dict) or not relative_path(copy.get('path'))
+                or not relative_path(copy.get('originPath'))
+                or not isinstance(copy.get('revision'), str)
+                or not GIT_REVISION.fullmatch(copy['revision'])):
+            continue
+        files, modes = copy.get('files'), copy.get('modes')
+        if (not isinstance(files, dict) or not files or not isinstance(modes, dict)
+                or set(files) != set(modes)):
+            continue
+        pending = set()
+        for name, digest in files.items():
+            if (not relative_path(name) or not (name == copy['path'] or name.startswith(copy['path'] + '/'))
+                    or not isinstance(digest, str) or not HEX.fullmatch(digest)
+                    or modes[name] not in ('100644', '100755')):
+                break
+            value = read_regular(name)
+            if (value is None or value[1] != modes[name]
+                    or hashlib.sha256(value[0]).hexdigest() != digest):
+                break
+            pending.add(('copies', index, 'files', name))
+        else:
+            allowed.update(pending)
+    return allowed

package/scripts/publish-check/der.py

@@ -0,0 +1,61 @@
+"""Strict, bounded DER reading for X.501 Names and SubjectPublicKeyInfo."""
+SET, SEQUENCE, OID, BIT_STRING = 0x31, 0x30, 0x06, 0x03
+
+
+def tlv(data, offset, end):
+    """(tag, content start, content end) of one minimally encoded definite TLV."""
+    if offset + 2 > end or data[offset] & 0x1f == 0x1f:
+        return None
+    start, length = offset + 2, data[offset + 1]
+    if length & 0x80:
+        count = length & 0x7f
+        if not 1 <= count <= 3 or start + count > end or data[start] == 0:
+            return None
+        length = int.from_bytes(data[start:start + count], 'big')
+        start += count
+        if length < 0x80:
+            return None
+    return (data[offset], start, start + length) if start + length <= end else None
+
+
+def rdn_values(data, offset, end):
+    """End and attribute value spans of one RelativeDistinguishedName SET."""
+    rdn = tlv(data, offset, end)
+    if not rdn or rdn[0] != SET or rdn[1] == rdn[2]:
+        return None
+    values, cursor = [], rdn[1]
+    while cursor < rdn[2]:
+        attribute = tlv(data, cursor, rdn[2])
+        if not attribute or attribute[0] != SEQUENCE:
+            return None
+        oid = tlv(data, attribute[1], attribute[2])
+        value = oid and oid[0] == OID and oid[1] < oid[2] and tlv(data, oid[2], attribute[2])
+        if not value or value[2] != attribute[2]:
+            return None
+        values.append((value[1], value[2]))
+        cursor = attribute[2]
+    return rdn[2], values
+
+
+def names(data):
+    """Every (start, end, value spans) RDNSequence content run, by each prefix."""
+    offset = data.find(SET)
+    while offset >= 0:
+        cursor, values = offset, []
+        while (rdn := rdn_values(data, cursor, len(data))):
+            cursor = rdn[0]
+            values += rdn[1]
+            yield offset, cursor, tuple(values)
+        offset = data.find(SET, offset + 1)
+
+
+def public_keys(data):
+    """Every (start, end) AlgorithmIdentifier + BIT STRING content run."""
+    offset = data.find(SEQUENCE)
+    while offset >= 0:
+        algorithm = tlv(data, offset, len(data))
+        if algorithm and algorithm[0] == SEQUENCE:
+            key = tlv(data, algorithm[2], len(data))
+            if key and key[0] == BIT_STRING:
+                yield offset, key[2]
+        offset = data.find(SEQUENCE, offset + 1)

package/scripts/publish-check/destination.py

@@ -0,0 +1,117 @@
+"""Bind one pending public destination to explicit context and committed identities."""
+import argparse
+import json
+import re
+from github_refs import FULL
+from project_identity import FIELDS, ordinary_document, tree_identity
+
+RULE = 'pending-public-destination'
+INVALID = 'destination.invalid'
+MANIFESTS = ('edition.json', 'rer-project.json')
+URL = re.compile(r'https://github\.com/([^/]+/[^/]+)', re.IGNORECASE | re.ASCII)
+
+
+def identity(value, url=False):
+    if not isinstance(value, str):
+        raise ValueError('invalid destination identity')
+    if url:
+        match = URL.fullmatch(value)
+        if not match:
+            raise ValueError('invalid destination URL')
+        value = match[1]
+        if value.lower().endswith('.git'):
+            value = value[:-4]
+    if not FULL.fullmatch(value) or any(part.endswith('.') for part in value.split('/')):
+        raise ValueError('invalid destination identity')
+    return value.lower()
+
+
+def unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError('duplicate manifest key')
+        result[key] = value
+    return result
+
+
+def reject_constant(value):
+    raise ValueError('destination manifest contains a nonstandard JSON constant')
+
+
+def repository_identity(value):
+    # Bare declarations are supported only by the explicit logical-project path.
+    # A .git suffix has transport meaning in a URL, not in a bare identity.
+    if isinstance(value, str) and URL.fullmatch(value):
+        return identity(value, url=True)
+    if isinstance(value, str) and value.lower().endswith('.git'):
+        raise ValueError('invalid bare destination identity')
+    return identity(value)
+
+
+def destination(history, project=None, repository=None):
+    # Metadata alone never enables the pending-destination classification.
+    if project is None and repository is None:
+        return None
+    # Logical projects use the recipe's canonical ID, not GitHub slug rules.
+    project_value = project
+    target = identity(repository, url=True)
+    # A recursive blob inventory omits empty trees. Read the actual root entries
+    # so every nonordinary declaration is present and rejected, including those trees.
+    named = {e['path']: e for e in history.root_entries(history.commit) if e['path'] in FIELDS}
+    present = any(name in named for name in MANIFESTS)
+    if not present:
+        identity(project)
+        return None  # Legacy sources retain strict reference inspection.
+    documents = []
+    for name in MANIFESTS:
+        entry = named.get(name)
+        if not ordinary_document(entry):
+            raise ValueError('destination manifest must be an ordinary committed file')
+        document = json.loads(history.blob(entry['oid']), object_pairs_hook=unique_object,
+                              parse_constant=reject_constant)
+        if not isinstance(document, dict):
+            raise ValueError('destination manifest must be an object')
+        documents.append(document)
+    edition, project_document = documents
+    if 'identityKind' in edition:
+        logical, invalid = tree_identity(history, named.values())
+        if invalid or logical is None or project != logical:
+            raise ValueError('invalid or inconsistent logical project identity')
+        # Validate the maintained recipe and same-tree lock before allowing bare
+        # repository declarations. Logical IDs and repository IDs bind separately.
+        project_values = [logical]
+        repository_value = repository_identity
+    else:
+        project_value = identity(project)
+        project_values = [identity(edition.get('id')), identity(project_document.get('projectId'))]
+        repository_value = lambda value: identity(value, url=True)
+    repository_values = [repository_value(project_document.get('sourceRepository'))]
+    if 'custody' in edition:
+        custody = edition['custody']
+        if not isinstance(custody, dict):
+            raise ValueError('invalid custody metadata')
+        if 'repository' in custody:
+            repository_values.append(repository_value(custody['repository']))
+    if (any(value != project_value for value in project_values) or
+            any(value != target for value in repository_values)):
+        raise ValueError('destination disagreement')
+    return target
+
+
+if __name__ == '__main__':
+    # The producer uses this same validator before installs or output creation.
+    from git_history import History, InspectionError
+    parser = argparse.ArgumentParser()
+    for name in ('repo', 'ref', 'project', 'repository'):
+        parser.add_argument('--' + name, required=True)
+    args = parser.parse_args()
+    history = None
+    try:
+        history = History(args.repo, args.ref)
+        destination(history, args.project, args.repository)
+    except (ValueError, TypeError, UnicodeError, OSError, InspectionError):
+        raise SystemExit(1) from None
+    finally:
+        if history:
+            history.close()

package/scripts/publish-check/env_values.py

@@ -0,0 +1,74 @@
+"""Read dotenv values into in-memory digests; never retain or report plaintext."""
+import hashlib
+import re
+from pathlib import Path
+
+
+def digest(value):
+    return hashlib.sha256(value).digest()
+
+
+def load_hashes(path):
+    if path is None:
+        return set()
+    return load_hashes_and_digest(path)[0]
+
+
+def load_hashes_and_digest(path):
+    if path is None:
+        return frozenset(), None
+    with Path(path).expanduser().open('rb') as stream:
+        raw = stream.read(16 * 1024 * 1024 + 1)
+    if len(raw) > 16 * 1024 * 1024:
+        raise ValueError("environment file too large")
+    # Digest exact bytes, including comments/line endings; mtime is irrelevant.
+    text = raw.decode('utf-8').replace('\r\n', '\n').replace('\r', '\n')
+    return frozenset(value_hashes(text)), hashlib.sha256(raw).hexdigest()
+
+
+def value_hashes(text):
+    text = text.lstrip('\ufeff')
+    hashes = set()
+    # No evaluation, expansion, subprocesses or diagnostics containing input.
+    assignment = re.compile(r'(?:export[ \t]+)?[A-Za-z_][A-Za-z0-9_]*[ \t]*=[ \t]*')
+    cursor = 0
+    while cursor < len(text):
+        if text[cursor].isspace():
+            cursor += 1
+            continue
+        if text[cursor] == '#':
+            end = text.find('\n', cursor)
+            cursor = len(text) if end < 0 else end + 1
+            continue
+        match = assignment.match(text, cursor)
+        if not match:
+            raise ValueError('invalid environment file')
+        cursor = match.end()
+        if cursor < len(text) and text[cursor] in "\"'":
+            quote = text[cursor]
+            cursor += 1
+            value = []
+            while cursor < len(text) and text[cursor] != quote:
+                char = text[cursor]
+                if quote == '"' and char == '\\' and cursor + 1 < len(text):
+                    cursor += 1
+                    char = {'n': '\n', 'r': '\r', 't': '\t', '"': '"', '\\': '\\'}.get(text[cursor], '\\' + text[cursor])
+                value.append(char)
+                cursor += 1
+            if cursor == len(text):
+                raise ValueError('invalid environment file')
+            cursor += 1
+            end = text.find('\n', cursor)
+            end = len(text) if end < 0 else end
+            tail = text[cursor:end].strip()
+            if tail and not tail.startswith('#'):
+                raise ValueError('invalid environment file')
+            value = ''.join(value)
+        else:
+            end = text.find('\n', cursor)
+            end = len(text) if end < 0 else end
+            value = re.split(r'\s+#', text[cursor:end], maxsplit=1)[0].strip()
+        cursor = end + 1
+        if value:
+            hashes.add(digest(value.encode()))
+    return hashes