plugin-scanner 2.0.933__tar.gz → 2.0.935__tar.gz

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.933
+Version: 2.0.935
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.933"
+version = "2.0.935"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.933"
+version = "2.0.935"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/src/codex_plugin_scanner/guard/access_graph_events.py

@@ -215,7 +215,16 @@ def _add_artifact_entities(
 
 
 def _access_graph_entity_type(artifact_type: str) -> str:
-    if artifact_type in {"skill", "mcp_server", "tool", "repository", "agent", "policy", "integration"}:
+    if artifact_type in {
+        "skill",
+        "mcp_server",
+        "tool",
+        "repository",
+        "agent",
+        "policy",
+        "integration",
+        "instruction",
+    }:
         return artifact_type
     return "tool"
 
@@ -225,6 +234,8 @@ def _access_graph_artifact_edge_type(entity_type: str) -> str | None:
         return "agent_uses_skill"
     if entity_type == "mcp_server":
         return "agent_uses_mcp_server"
+    if entity_type == "instruction":
+        return "agent_uses_instruction"
     return None
 
 

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/src/codex_plugin_scanner/guard/aibom_trust_metadata.py

@@ -131,7 +131,7 @@ def apply_local_trust_metadata(
         )
     )
 
-    local_security = _local_skill_security_for_artifact(
+    local_security = _local_security_for_artifact(
         artifact,
         item_kind=item_kind,
         metadata=metadata,
@@ -147,6 +147,34 @@ def apply_local_trust_metadata(
     return enriched
 
 
+def _local_security_for_artifact(
+    artifact: object,
+    *,
+    item_kind: InventoryItemKind,
+    metadata: dict[str, object],
+    captured_at: str,
+    cisco_runs: tuple[object, ...],
+    workspace_dir: Path | None,
+) -> dict[str, object] | None:
+    skill_security = _local_skill_security_for_artifact(
+        artifact,
+        item_kind=item_kind,
+        metadata=metadata,
+        captured_at=captured_at,
+        cisco_runs=cisco_runs,
+        workspace_dir=workspace_dir,
+    )
+    if skill_security is not None:
+        return skill_security
+    return _local_mcp_security_for_artifact(
+        artifact,
+        item_kind=item_kind,
+        captured_at=captured_at,
+        cisco_runs=cisco_runs,
+        workspace_dir=workspace_dir,
+    )
+
+
 def _local_skill_security_for_artifact(
     artifact: object,
     *,
@@ -243,6 +271,152 @@ def _local_skill_security_for_artifact(
     }
 
 
+def _local_mcp_security_for_artifact(
+    artifact: object,
+    *,
+    item_kind: InventoryItemKind,
+    captured_at: str,
+    cisco_runs: tuple[object, ...],
+    workspace_dir: Path | None,
+) -> dict[str, object] | None:
+    from .inventory_contract import _normalize_inventory_datetime
+
+    if item_kind != "mcp_server" or getattr(artifact, "artifact_type", None) != "mcp_server":
+        return None
+
+    trust_root = _trust_root_for_artifact(artifact, item_kind=item_kind, workspace_dir=workspace_dir)
+    if trust_root is None:
+        return None
+
+    run = next(
+        (
+            candidate
+            for candidate in cisco_runs
+            if getattr(candidate, "source", None) == "cisco-mcp-scanner"
+            and _matches_mcp_cisco_run(artifact, run=candidate)
+        ),
+        None,
+    )
+    if run is None:
+        return None
+
+    status = str(getattr(run, "status", "unknown"))
+    normalized_captured_at = _normalize_inventory_datetime(captured_at)
+    scan_root = _cisco_run_target_path(run) or trust_root
+    findings = _local_mcp_security_findings(run, scan_root=scan_root)
+    findings = sorted(
+        findings,
+        key=lambda finding: (finding.get("file", ""), finding.get("ruleId", ""), finding.get("message", "")),
+    )
+    severity_counts = _cisco_severity_counts(run)
+    analyzers_used = _cisco_analyzers_used(run)
+    score = _cisco_layer_score(severity_counts, analyzers_used=analyzers_used) if status == "enabled" else None
+    safety = None
+    if score is not None:
+        safety = {
+            "score": score,
+            "label": _local_skill_security_label(score),
+            "findingsTotal": len(findings),
+            "highFindings": sum(1 for finding in findings if finding["severity"] == "high"),
+            "scriptsTotal": _local_mcp_targets_total(run),
+            "targetsScanned": _local_mcp_targets_total(run),
+            "permissionsMissing": [],
+        }
+
+    run_metadata = getattr(run, "metadata", None)
+    metadata_payload: dict[str, object] = {
+        "scannerSource": str(getattr(run, "source", "unknown")),
+        "message": str(getattr(run, "message", "")),
+        "findingsBySeverity": severity_counts,
+        "totalFindings": len(findings),
+    }
+    duration_ms = getattr(run, "duration_ms", None)
+    if isinstance(duration_ms, int):
+        metadata_payload["durationMs"] = duration_ms
+    if isinstance(run_metadata, dict):
+        for key in ("analyzersUsed", "scanMode", "mode", "targetsScanned"):
+            value = run_metadata.get(key)
+            if value is not None:
+                metadata_payload[key] = value
+
+    metadata_payload["evidenceHash"] = guard_evidence_hash(
+        {
+            "capturedAt": normalized_captured_at,
+            "entityType": "mcp_server",
+            "findings": findings,
+            "provider": "cisco-mcp-scanner",
+            "safety": safety,
+            "source": "local_indexed",
+            "status": status,
+        }
+    )
+
+    return {
+        "entityType": "mcp_server",
+        "source": "local_indexed",
+        "provider": "cisco-mcp-scanner",
+        "status": status,
+        "capturedAt": normalized_captured_at,
+        "safety": safety,
+        "findings": findings,
+        "metadata": metadata_payload,
+    }
+
+
+def _local_mcp_security_findings(
+    run: object,
+    *,
+    scan_root: Path,
+) -> list[dict[str, object]]:
+    results: list[dict[str, object]] = []
+    try:
+        resolved_scan_root = scan_root.resolve()
+    except OSError:
+        resolved_scan_root = scan_root
+    for finding in tuple(getattr(run, "findings", ()) or ()):
+        file_path = getattr(finding, "file_path", None)
+        if isinstance(file_path, str) and file_path.strip():
+            raw_path = Path(file_path)
+            path = raw_path if raw_path.is_absolute() else scan_root / raw_path
+            if not _paths_related(scan_root, path):
+                continue
+            try:
+                relative_file = str(path.resolve().relative_to(resolved_scan_root))
+            except ValueError:
+                relative_file = path.name
+        else:
+            relative_file = ".mcp.json"
+
+        results.append(
+            {
+                "ruleId": str(getattr(finding, "rule_id", "unknown")),
+                "severity": _local_skill_security_severity(getattr(finding, "severity", None)),
+                "file": relative_file,
+                "message": _local_mcp_security_message(finding),
+            }
+        )
+    return results
+
+
+def _local_mcp_security_message(finding: object) -> str:
+    description = getattr(finding, "description", None)
+    if isinstance(description, str) and description.strip():
+        return description.strip()
+    title = getattr(finding, "title", None)
+    if isinstance(title, str) and title.strip():
+        return title.strip()
+    return "MCP security finding"
+
+
+def _local_mcp_targets_total(run: object) -> int:
+    metadata = getattr(run, "metadata", None)
+    if isinstance(metadata, dict):
+        value = metadata.get("targetsScanned")
+        if isinstance(value, int):
+            return max(0, value)
+    return 0
+
+
 def _local_skill_security_findings(
     run: object,
     *,
@@ -507,7 +681,14 @@ def _cisco_trust_layers_for_artifact(
                     label="Cisco Skill Scanner",
                 )
             )
-        if source == "cisco-mcp-scanner" and item_kind == "mcp_server" and _matches_mcp_cisco_run(artifact, run=run):
+        if (
+            source == "cisco-mcp-scanner"
+            and item_kind in {"mcp_server", "mcp_tool"}
+            and _matches_mcp_cisco_run(
+                artifact,
+                run=run,
+            )
+        ):
             layers.append(
                 _cisco_trust_layer(
                     run,
@@ -537,11 +718,16 @@ def _matches_skill_cisco_run(
 
 
 def _matches_mcp_cisco_run(artifact: object, *, run: object) -> bool:
-    run_target = _cisco_run_target_path(run)
+    run_config_path = _cisco_run_config_path(run)
     config_path = getattr(artifact, "config_path", None)
-    if run_target is None or not isinstance(config_path, str) or not config_path.strip():
+    if not isinstance(config_path, str) or not config_path.strip():
         return False
     path = Path(config_path)
+    if run_config_path is not None:
+        return _paths_related(path, run_config_path)
+    run_target = _cisco_run_target_path(run)
+    if run_target is None:
+        return False
     if path.is_file() and (_paths_related(path, run_target) or _paths_related(path.parent, run_target)):
         return True
     return _paths_related(path, run_target)
@@ -560,10 +746,23 @@ def _paths_related(left: Path, right: Path) -> bool:
     )
 
 
+def _cisco_run_config_path(run: object) -> Path | None:
+    metadata = getattr(run, "metadata", None)
+    if not isinstance(metadata, dict):
+        return None
+    config_path = metadata.get("_configPath")
+    if not isinstance(config_path, str) or not config_path.strip():
+        return None
+    return Path(config_path)
+
+
 def _cisco_run_target_path(run: object) -> Path | None:
     metadata = getattr(run, "metadata", None)
     if not isinstance(metadata, dict):
         return None
+    target = metadata.get("_targetPath")
+    if isinstance(target, str) and target.strip() and target != "missing":
+        return Path(target)
     target = metadata.get("target")
     if not isinstance(target, str) or not target.strip() or target == "missing":
         return None

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/src/codex_plugin_scanner/guard/cli/progress.py

@@ -7,22 +7,11 @@ All output goes to stderr so stdout stays clean for --json mode.
 from __future__ import annotations
 
 import sys
+from importlib.util import find_spec
 from types import TracebackType
+from typing import Any
 
-try:
-    from rich.console import Console
-    from rich.progress import (
-        BarColumn,
-        Progress,
-        SpinnerColumn,
-        TaskProgressColumn,
-        TextColumn,
-        TimeElapsedColumn,
-    )
-
-    _RICH_AVAILABLE = True
-except ImportError:
-    _RICH_AVAILABLE = False
+_rich_available = find_spec("rich") is not None
 
 
 class GuardProgress:
@@ -42,9 +31,21 @@ class GuardProgress:
         self._total = total
         self._completed = 0
         self._title = title
-        self._use_rich = use_rich and _RICH_AVAILABLE
+        self._use_rich = use_rich and _rich_available
+        self._progress: Any | None = None
+        self._task: Any | None = None
 
         if self._use_rich:
+            from rich.console import Console
+            from rich.progress import (
+                BarColumn,
+                Progress,
+                SpinnerColumn,
+                TaskProgressColumn,
+                TextColumn,
+                TimeElapsedColumn,
+            )
+
             self._progress = Progress(
                 SpinnerColumn(spinner_name="dots"),
                 BarColumn(bar_width=None, complete_style="green", finished_style="green"),
@@ -55,9 +56,6 @@ class GuardProgress:
                 transient=False,
                 expand=True,
             )
-            self._task: object | None = None
-        else:
-            self._progress = None  # type: ignore[assignment]
 
     # -- context manager protocol -------------------------------------------
 

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/src/codex_plugin_scanner/guard/inventory_cisco.py

@@ -38,9 +38,10 @@ def run_cisco_inventory_scans(
     remaining_timeout_seconds = timeout_seconds
     if mcp_mode != "off":
         mcp_started = time.perf_counter()
-        runs.append(
-            _run_mcp_inventory_scan(
+        runs.extend(
+            _run_mcp_inventory_scans(
                 context=context,
+                detection=detection,
                 mode=mcp_mode,
                 timeout_seconds=remaining_timeout_seconds,
             )
@@ -62,33 +63,65 @@ def run_cisco_inventory_scans(
     return tuple(runs)
 
 
-def _run_mcp_inventory_scan(
+def _run_mcp_inventory_scans(
     *,
     context: HarnessContext,
+    detection: object,
     mode: str,
     timeout_seconds: float | None,
-) -> CiscoInventoryRun:
-    root = _mcp_scan_root(context)
-    if root is None:
-        return CiscoInventoryRun(
-            source="cisco-mcp-scanner",
-            status="skipped",
-            message="No .mcp.json found; Cisco MCP inventory scan skipped.",
-            findings=(),
-            duration_ms=0,
-            metadata={"target": "missing", "targetsScanned": 0, "mode": mode},
+) -> tuple[CiscoInventoryRun, ...]:
+    targets = _mcp_scan_targets(context=context, detection=detection)
+    if not targets:
+        return (
+            CiscoInventoryRun(
+                source="cisco-mcp-scanner",
+                status="skipped",
+                message="No MCP configuration found; Cisco MCP inventory scan skipped.",
+                findings=(),
+                duration_ms=0,
+                metadata={"target": "missing", "targetsScanned": 0, "mode": mode},
+            ),
         )
-    if timeout_seconds is not None and timeout_seconds <= 0:
-        return CiscoInventoryRun(
-            source="cisco-mcp-scanner",
-            status="timed_out",
-            message="Cisco MCP inventory scan timed out before Guard could start it.",
-            findings=(),
-            duration_ms=0,
-            metadata={"target": root.name, "targetsScanned": 0, "mode": mode},
+    remaining_timeout_seconds = timeout_seconds
+    runs: list[CiscoInventoryRun] = []
+    for root, config_path in targets:
+        if remaining_timeout_seconds is not None and remaining_timeout_seconds <= 0:
+            runs.append(
+                _build_mcp_inventory_budget_exhausted_run(
+                    root=root,
+                    config_path=config_path,
+                    mode=mode,
+                    workspace_dir=context.workspace_dir,
+                )
+            )
+            continue
+        started = time.perf_counter()
+        runs.append(
+            _run_single_mcp_inventory_scan(
+                root=root,
+                config_path=config_path,
+                mode=mode,
+                timeout_seconds=remaining_timeout_seconds,
+                workspace_dir=context.workspace_dir,
+            )
         )
+        remaining_timeout_seconds = _consume_timeout_budget(
+            remaining_timeout_seconds,
+            started_at=started,
+        )
+    return tuple(runs)
+
+
+def _run_single_mcp_inventory_scan(
+    *,
+    root: Path,
+    config_path: Path,
+    mode: str,
+    timeout_seconds: float | None,
+    workspace_dir: Path | None,
+) -> CiscoInventoryRun:
     started = time.perf_counter()
-    summary = run_cisco_mcp_scan(root, mode=mode, timeout_seconds=timeout_seconds)
+    summary = run_cisco_mcp_scan(root, mode=mode, timeout_seconds=timeout_seconds, config_path=config_path)
     duration_ms = int((time.perf_counter() - started) * 1000)
     return CiscoInventoryRun(
         source="cisco-mcp-scanner",
@@ -97,7 +130,9 @@ def _run_mcp_inventory_scan(
         findings=summary.findings,
         duration_ms=duration_ms,
         metadata={
-            "target": root.name,
+            "target": _safe_mcp_target_label(root=root, config_path=config_path, workspace_dir=workspace_dir),
+            "_targetPath": str(root),
+            "_configPath": str(config_path),
             "targetsScanned": summary.targets_scanned,
             "totalFindings": summary.total_findings,
             "findingsBySeverity": summary.findings_by_severity,
@@ -108,6 +143,25 @@ def _run_mcp_inventory_scan(
     )
 
 
+def _build_mcp_inventory_budget_exhausted_run(
+    *, root: Path, config_path: Path, mode: str, workspace_dir: Path | None
+) -> CiscoInventoryRun:
+    return CiscoInventoryRun(
+        source="cisco-mcp-scanner",
+        status="timed_out",
+        message="Cisco MCP inventory scan timed out before Guard could start this configuration.",
+        findings=(),
+        duration_ms=0,
+        metadata={
+            "target": _safe_mcp_target_label(root=root, config_path=config_path, workspace_dir=workspace_dir),
+            "_targetPath": str(root),
+            "_configPath": str(config_path),
+            "targetsScanned": 0,
+            "mode": mode,
+        },
+    )
+
+
 def _run_skill_inventory_scans(
     *,
     harness: str,
@@ -197,15 +251,70 @@ def _build_skill_inventory_budget_exhausted_run(*, root: Path, mode: str) -> Cis
     )
 
 
-def _mcp_scan_root(context: HarnessContext) -> Path | None:
-    candidates = []
-    if context.workspace_dir is not None:
-        candidates.append(context.workspace_dir)
-    candidates.append(context.home_dir)
-    for candidate in candidates:
-        if (candidate / ".mcp.json").is_file():
-            return candidate
-    return None
+def _mcp_scan_targets(*, context: HarnessContext, detection: object) -> tuple[tuple[Path, Path], ...]:
+    targets: list[tuple[Path, Path]] = []
+    seen: set[str] = set()
+
+    for base_dir in (context.workspace_dir, context.home_dir):
+        if base_dir is None:
+            continue
+        config_path = base_dir / ".mcp.json"
+        if config_path.is_file():
+            _extend_unique_mcp_targets(targets, seen, root=base_dir, config_path=config_path)
+
+    for artifact in tuple(getattr(detection, "artifacts", ())):
+        if str(getattr(artifact, "artifact_type", "")) != "mcp_server":
+            continue
+        config_value = getattr(artifact, "config_path", None)
+        if not isinstance(config_value, str) or not config_value.strip():
+            continue
+        config_path = Path(config_value)
+        if not config_path.is_file():
+            continue
+        root = _mcp_scan_root_for_config(config_path, context=context)
+        _extend_unique_mcp_targets(targets, seen, root=root, config_path=config_path)
+
+    return tuple(targets)
+
+
+def _extend_unique_mcp_targets(
+    targets: list[tuple[Path, Path]],
+    seen: set[str],
+    *,
+    root: Path,
+    config_path: Path,
+) -> None:
+    try:
+        key = f"{root.resolve()}::{config_path.resolve()}"
+    except OSError:
+        return
+    if key in seen:
+        return
+    seen.add(key)
+    targets.append((root, config_path))
+
+
+def _mcp_scan_root_for_config(config_path: Path, *, context: HarnessContext) -> Path:
+    workspace_dir = context.workspace_dir
+    if workspace_dir is None:
+        return config_path.parent
+    try:
+        config_path.resolve().relative_to(workspace_dir.resolve())
+    except (OSError, ValueError):
+        return config_path.parent
+    return workspace_dir
+
+
+def _safe_mcp_target_label(*, root: Path, config_path: Path, workspace_dir: Path | None = None) -> str:
+    if workspace_dir is not None:
+        try:
+            return config_path.resolve().relative_to(workspace_dir.resolve()).as_posix()
+        except (OSError, ValueError):
+            pass
+    try:
+        return config_path.resolve().relative_to(root.resolve()).as_posix()
+    except (OSError, ValueError):
+        return config_path.name
 
 
 def _skill_scan_roots(*, harness: str, context: HarnessContext, detection: object) -> tuple[Path, ...]:

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/src/codex_plugin_scanner/guard/inventory_contract.py

@@ -430,6 +430,7 @@ def inventory_snapshot_from_detection(
                 generated_at=generated_at,
                 home_dir=home_dir,
                 workspace_dir=workspace_dir,
+                cisco_runs=cisco_runs,
                 trust_attestation_context=trust_attestation_context,
             )
         )
@@ -724,6 +725,7 @@ def _mcp_tool_items_from_artifact(
     generated_at: str,
     home_dir: Path,
     workspace_dir: Path | None,
+    cisco_runs: tuple[object, ...] = (),
     trust_attestation_context: Mapping[str, object] | None = None,
 ) -> tuple[GuardAgentInventoryItem, ...]:
     artifact_type = str(getattr(artifact, "artifact_type", "unknown"))
@@ -787,6 +789,7 @@ def _mcp_tool_items_from_artifact(
             item_kind="mcp_tool",
             metadata=metadata,
             workspace_dir=workspace_dir,
+            cisco_runs=cisco_runs,
         )
         capabilities = _capabilities_for_mcp_tool(name, description, input_schema, safe_annotations)
         tool_item_id = f"{server_item.item_id}:tool:{name}"
@@ -807,9 +810,33 @@ def _mcp_tool_items_from_artifact(
             content_hash=semantic_hash,
             trust_attestation_context=trust_attestation_context,
         )
-        if inherited_layers:
-            tool_layers = metadata.get("trustLayers")
-            signed_tool_layers = list(tool_layers) if isinstance(tool_layers, list) else []
+        tool_layers = metadata.get("trustLayers")
+        signed_tool_layers = list(tool_layers) if isinstance(tool_layers, list) else []
+        normalized_tool_layers: list[dict[str, object]] = []
+        for layer in signed_tool_layers:
+            if isinstance(layer, dict) and layer.get("layerType") == "cisco_mcp_scanner":
+                raw_layer_metadata = layer.get("metadata")
+                layer_metadata = dict(raw_layer_metadata) if isinstance(raw_layer_metadata, dict) else {}
+                normalized_tool_layers.append(
+                    {
+                        **layer,
+                        "metadata": {
+                            **{
+                                key: value
+                                for key, value in layer_metadata.items()
+                                if key not in {"attestation", "attestationBindings"}
+                            },
+                            "attestationStatus": "unsigned",
+                        },
+                    }
+                )
+            elif isinstance(layer, dict):
+                normalized_tool_layers.append(layer)
+        signed_tool_layers = normalized_tool_layers
+        if signed_tool_layers:
+            metadata["trustLayers"] = signed_tool_layers
+        has_tool_cisco_layer = any(layer.get("layerType") == "cisco_mcp_scanner" for layer in signed_tool_layers)
+        if inherited_layers and not has_tool_cisco_layer:
             inherited_tool_layers: list[dict[str, object]] = []
             for layer in inherited_layers:
                 raw_layer_metadata = layer.get("metadata")
@@ -818,7 +845,11 @@ def _mcp_tool_items_from_artifact(
                     {
                         **layer,
                         "metadata": {
-                            **{key: value for key, value in layer_metadata.items() if key != "attestation"},
+                            **{
+                                key: value
+                                for key, value in layer_metadata.items()
+                                if key not in {"attestation", "attestationBindings"}
+                            },
                             "attestationStatus": "unsigned",
                             "inheritedFromServerItemId": server_item.item_id,
                         },

{plugin_scanner-2.0.933 → plugin_scanner-2.0.935}/src/codex_plugin_scanner/guard/policy_bundle_parser.py

@@ -346,11 +346,14 @@ def validated_policy_bundle_payload(
     # bundleHash check below provides the primary integrity guarantee. Log
     # the mismatch but don't reject — blocking here prevents valid bundles
     # from being stored, which breaks per-rule enforcement.
-    if payload_hash is not None and payload_hash != computed_payload_hash and payload_hash != f"sha256:{computed_payload_hash}":
+    if (
+        payload_hash is not None
+        and payload_hash != computed_payload_hash
+        and payload_hash != f"sha256:{computed_payload_hash}"
+    ):
         import logging
-        logging.getLogger(__name__).warning(
-            "payload_hash_mismatch: portal=%s computed=%s", payload_hash, computed_payload_hash,
-        )
+
+        logging.getLogger(__name__).warning("payload_hash_mismatch")
     bundle_hash = _non_empty_string(policy_bundle.get("bundleHash"))
     if bundle_hash is None:
         return None, "invalid_bundle_hash"