qlib-sync 0.1.0__tar.gz → 0.2.0__tar.gz

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: qlib-sync
-Version: 0.1.0
+Version: 0.2.0
 Summary: Safely install and update a local Qlib China A-share dataset, with an MCP server for AI assistants.
 Project-URL: Homepage, https://github.com/randyy179/qlib-sync
 Project-URL: Issues, https://github.com/randyy179/qlib-sync/issues
@@ -46,7 +46,9 @@ pip install qlib-sync
 qlib-sync cn update
 ```
 
-Or without installing anything first: `uvx qlib-sync cn update`.
+Or without installing anything first: `uvx --python 3.12 qlib-sync cn update`.
+(`--python 3.12` because pyqlib publishes wheels up to Python 3.12; uv fetches that Python
+for you if needed. With pip, use Python 3.10 to 3.12.)
 
 ![qlib-sync updating the dataset: status, download with progress, checksum, summary, then an instant no-op](https://raw.githubusercontent.com/randyy179/qlib-sync/main/docs/assets/demo-update.gif)
 
@@ -70,9 +72,15 @@ That works until it doesn't:
 - **Every check downloads 550 MB**, even when nothing changed.
 
 The investment_data README itself describes a careful manual process: download the release
-manifest, check the archive with its `validate_archive.py`, then extract. qlib-sync runs the
-same checks automatically on every update and adds what a manual process cannot: it skips the
-download when nothing changed, extracts beside the live data and swaps it in with rollback
+manifest, check the archive with `qlib/validate_archive.py --require-publishable`, then
+extract. qlib-sync runs that validator itself, on every update: an unmodified copy (from
+[commit 68fdc66](https://github.com/chenditc/investment_data/blob/68fdc66b109459e522050c94723684525aea23ab/qlib/validate_archive.py),
+Apache-2.0) checks the manifest before the download and the archive after it. A test suite
+feeds the same malformed releases to the upstream script and to qlib-sync and requires the same
+verdict, and a weekly job flags any change upstream makes to the validator.
+
+On top of that, qlib-sync skips the download when nothing changed, pins the manifest and the
+archive to one release tag, extracts beside the live data and swaps it in with rollback
 (rather than extracting on top of the existing folder), and picks up republished releases.
 
 qlib-sync treats the dataset like a production system:
@@ -84,17 +92,22 @@ qlib-sync treats the dataset like a production system:
 
 | Step | What happens |
 |---|---|
-| Check | Reads the release's 500-byte manifest. Already current: done, nothing downloaded. |
+| Check | Pins the latest release by tag and reads its 500-byte manifest. Already current: done, nothing downloaded. |
 | Download | Resumes interrupted downloads; shows progress; optional mirror for slow links to GitHub. |
-| Verify | Size and sha256 from the manifest; the same release checks as upstream's `validate_archive.py` (every index pool and the future calendar reach the manifest's dates, release marked publishable); archive paths and links are checked before extraction. |
+| Verify | investment_data's own `validate_archive.py --require-publishable`, unmodified: manifest fields and formats, size and sha256, every required calendar and index pool, date formats, ordering, and the future calendar. Anything it rejects is refused. |
 | Stage | Extracts next to the active dataset; refuses downgrades. |
 | Swap | Renames the new dataset into place, then runs a real Qlib read. |
 | Roll back | Any failure after the swap moves the previous dataset back. |
 | Report | New trading days, newly listed and delisted symbols. |
 
-The checks catch broken, truncated, or tampered packages. They cannot catch wrong values inside a
-correctly published release (like the one in #163); for that, keep a rollback copy with
-`--keep-backup`.
+**Verification is required by default.** If the manifest is missing, unreadable, or rejected by
+the validator, the update stops and your data stays as it was. `--allow-unverified` installs
+anyway when the manifest cannot be verified, and the result and install record are then marked
+unverified; a package whose checksum disagrees with a valid manifest is always refused.
+
+The checks catch broken, truncated, tampered, or malformed packages. They cannot catch wrong
+values inside a correctly published release (like the one in #163); for that, keep a rollback
+copy with `--keep-backup`.
 
 ## Commands
 
@@ -115,6 +128,7 @@ Useful options for `cn update`:
 | `--keep-backup` | Keep the previous dataset for one rollback |
 | `--protect FILE` | Carry a custom stock pool in `instruments/` across updates (repeatable) |
 | `--force` | Reinstall even when the dates match |
+| `--allow-unverified` | Install when the manifest cannot be verified (marked unverified; checksum mismatches are still refused) |
 
 **The update replaces the whole `cn_data` folder.** Anything you added there is lost unless you
 pass it with `--protect`.
@@ -150,17 +164,17 @@ Every client needs the same two things: the command `uvx` and the arguments `qli
 | Client | How to add qlib-sync |
 |---|---|
 | Claude Desktop | Download `qlib-sync.mcpb` from the [latest release](https://github.com/randyy179/qlib-sync/releases/latest) and open it |
-| Claude Code | `claude mcp add qlib-sync -- uvx qlib-sync mcp` |
-| OpenAI Codex CLI | `codex mcp add qlib-sync -- uvx qlib-sync mcp` |
+| Claude Code | `claude mcp add qlib-sync -- uvx --python 3.12 qlib-sync mcp` |
+| OpenAI Codex CLI | `codex mcp add qlib-sync -- uvx --python 3.12 qlib-sync mcp` |
 | Cursor | The JSON below, in `~/.cursor/mcp.json` |
 | Gemini CLI | The JSON below, in `~/.gemini/settings.json` |
 | Qwen Code | The JSON below, in `~/.qwen/settings.json` |
 | Tencent CodeBuddy, ByteDance Trae, Alibaba Tongyi Lingma | MCP settings, add a server manually, paste the JSON below |
-| Cherry Studio | Settings, MCP servers, add: type STDIO, command `uvx`, arguments `qlib-sync` and `mcp` on separate lines |
-| VS Code (Copilot agent mode) | `.vscode/mcp.json`: `{ "servers": { "qlib-sync": { "type": "stdio", "command": "uvx", "args": ["qlib-sync", "mcp"] } } }` |
+| Cherry Studio | Settings, MCP servers, add: type STDIO, command `uvx`, arguments `--python`, `3.12`, `qlib-sync`, `mcp` on separate lines |
+| VS Code (Copilot agent mode) | `.vscode/mcp.json`: `{ "servers": { "qlib-sync": { "type": "stdio", "command": "uvx", "args": ["--python", "3.12", "qlib-sync", "mcp"] } } }` |
 
 ```json
-{ "mcpServers": { "qlib-sync": { "command": "uvx", "args": ["qlib-sync", "mcp"] } } }
+{ "mcpServers": { "qlib-sync": { "command": "uvx", "args": ["--python", "3.12", "qlib-sync", "mcp"] } } }
 ```
 
 Menu names and file locations change between versions; check your client's MCP documentation

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/README.md

@@ -17,7 +17,9 @@ pip install qlib-sync
 qlib-sync cn update
 ```
 
-Or without installing anything first: `uvx qlib-sync cn update`.
+Or without installing anything first: `uvx --python 3.12 qlib-sync cn update`.
+(`--python 3.12` because pyqlib publishes wheels up to Python 3.12; uv fetches that Python
+for you if needed. With pip, use Python 3.10 to 3.12.)
 
 ![qlib-sync updating the dataset: status, download with progress, checksum, summary, then an instant no-op](docs/assets/demo-update.gif)
 
@@ -41,9 +43,15 @@ That works until it doesn't:
 - **Every check downloads 550 MB**, even when nothing changed.
 
 The investment_data README itself describes a careful manual process: download the release
-manifest, check the archive with its `validate_archive.py`, then extract. qlib-sync runs the
-same checks automatically on every update and adds what a manual process cannot: it skips the
-download when nothing changed, extracts beside the live data and swaps it in with rollback
+manifest, check the archive with `qlib/validate_archive.py --require-publishable`, then
+extract. qlib-sync runs that validator itself, on every update: an unmodified copy (from
+[commit 68fdc66](https://github.com/chenditc/investment_data/blob/68fdc66b109459e522050c94723684525aea23ab/qlib/validate_archive.py),
+Apache-2.0) checks the manifest before the download and the archive after it. A test suite
+feeds the same malformed releases to the upstream script and to qlib-sync and requires the same
+verdict, and a weekly job flags any change upstream makes to the validator.
+
+On top of that, qlib-sync skips the download when nothing changed, pins the manifest and the
+archive to one release tag, extracts beside the live data and swaps it in with rollback
 (rather than extracting on top of the existing folder), and picks up republished releases.
 
 qlib-sync treats the dataset like a production system:
@@ -55,17 +63,22 @@ qlib-sync treats the dataset like a production system:
 
 | Step | What happens |
 |---|---|
-| Check | Reads the release's 500-byte manifest. Already current: done, nothing downloaded. |
+| Check | Pins the latest release by tag and reads its 500-byte manifest. Already current: done, nothing downloaded. |
 | Download | Resumes interrupted downloads; shows progress; optional mirror for slow links to GitHub. |
-| Verify | Size and sha256 from the manifest; the same release checks as upstream's `validate_archive.py` (every index pool and the future calendar reach the manifest's dates, release marked publishable); archive paths and links are checked before extraction. |
+| Verify | investment_data's own `validate_archive.py --require-publishable`, unmodified: manifest fields and formats, size and sha256, every required calendar and index pool, date formats, ordering, and the future calendar. Anything it rejects is refused. |
 | Stage | Extracts next to the active dataset; refuses downgrades. |
 | Swap | Renames the new dataset into place, then runs a real Qlib read. |
 | Roll back | Any failure after the swap moves the previous dataset back. |
 | Report | New trading days, newly listed and delisted symbols. |
 
-The checks catch broken, truncated, or tampered packages. They cannot catch wrong values inside a
-correctly published release (like the one in #163); for that, keep a rollback copy with
-`--keep-backup`.
+**Verification is required by default.** If the manifest is missing, unreadable, or rejected by
+the validator, the update stops and your data stays as it was. `--allow-unverified` installs
+anyway when the manifest cannot be verified, and the result and install record are then marked
+unverified; a package whose checksum disagrees with a valid manifest is always refused.
+
+The checks catch broken, truncated, tampered, or malformed packages. They cannot catch wrong
+values inside a correctly published release (like the one in #163); for that, keep a rollback
+copy with `--keep-backup`.
 
 ## Commands
 
@@ -86,6 +99,7 @@ Useful options for `cn update`:
 | `--keep-backup` | Keep the previous dataset for one rollback |
 | `--protect FILE` | Carry a custom stock pool in `instruments/` across updates (repeatable) |
 | `--force` | Reinstall even when the dates match |
+| `--allow-unverified` | Install when the manifest cannot be verified (marked unverified; checksum mismatches are still refused) |
 
 **The update replaces the whole `cn_data` folder.** Anything you added there is lost unless you
 pass it with `--protect`.
@@ -121,17 +135,17 @@ Every client needs the same two things: the command `uvx` and the arguments `qli
 | Client | How to add qlib-sync |
 |---|---|
 | Claude Desktop | Download `qlib-sync.mcpb` from the [latest release](https://github.com/randyy179/qlib-sync/releases/latest) and open it |
-| Claude Code | `claude mcp add qlib-sync -- uvx qlib-sync mcp` |
-| OpenAI Codex CLI | `codex mcp add qlib-sync -- uvx qlib-sync mcp` |
+| Claude Code | `claude mcp add qlib-sync -- uvx --python 3.12 qlib-sync mcp` |
+| OpenAI Codex CLI | `codex mcp add qlib-sync -- uvx --python 3.12 qlib-sync mcp` |
 | Cursor | The JSON below, in `~/.cursor/mcp.json` |
 | Gemini CLI | The JSON below, in `~/.gemini/settings.json` |
 | Qwen Code | The JSON below, in `~/.qwen/settings.json` |
 | Tencent CodeBuddy, ByteDance Trae, Alibaba Tongyi Lingma | MCP settings, add a server manually, paste the JSON below |
-| Cherry Studio | Settings, MCP servers, add: type STDIO, command `uvx`, arguments `qlib-sync` and `mcp` on separate lines |
-| VS Code (Copilot agent mode) | `.vscode/mcp.json`: `{ "servers": { "qlib-sync": { "type": "stdio", "command": "uvx", "args": ["qlib-sync", "mcp"] } } }` |
+| Cherry Studio | Settings, MCP servers, add: type STDIO, command `uvx`, arguments `--python`, `3.12`, `qlib-sync`, `mcp` on separate lines |
+| VS Code (Copilot agent mode) | `.vscode/mcp.json`: `{ "servers": { "qlib-sync": { "type": "stdio", "command": "uvx", "args": ["--python", "3.12", "qlib-sync", "mcp"] } } }` |
 
 ```json
-{ "mcpServers": { "qlib-sync": { "command": "uvx", "args": ["qlib-sync", "mcp"] } } }
+{ "mcpServers": { "qlib-sync": { "command": "uvx", "args": ["--python", "3.12", "qlib-sync", "mcp"] } } }
 ```
 
 Menu names and file locations change between versions; check your client's MCP documentation

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/README.zh-CN.md

@@ -11,7 +11,8 @@ pip install qlib-sync
 qlib-sync cn update
 ```
 
-也可以不预先安装，直接运行：`uvx qlib-sync cn update`。
+也可以不预先安装，直接运行：`uvx --python 3.12 qlib-sync cn update`。
+（加 `--python 3.12` 是因为 pyqlib 只提供到 Python 3.12 的安装包，需要时 uv 会自动下载这个版本的 Python。用 pip 安装时请使用 Python 3.10 到 3.12。）
 
 ![qlib-sync 更新数据：查看状态、带进度下载、校验、汇报变化，再运行一次瞬间完成](docs/assets/demo-update.gif)
 
@@ -27,7 +28,9 @@ Qlib 的 README 推荐用 `wget` 下载社区数据包再用 `tar` 解压。平
 - **上游会重新发布**：2026 年 11 月，上游发现并修正了一处数据错误（[investment_data#163](https://github.com/chenditc/investment_data/issues/163)），用同一个日期重新发布了数据包。只比较日期的话，永远拿不到修复后的数据。
 - **每次检查都要下载 550MB**，即使什么都没变。
 
-investment_data 自己的 README 也给出了一套严谨的手动流程：下载发布清单（manifest），用它的 `validate_archive.py` 校验数据包，再解压。qlib-sync 每次更新都自动执行同样的校验，并补上手动流程做不到的部分：没有新数据时不下载；在旧数据旁边解压，校验通过后整体切换、失败回滚（而不是直接解压覆盖到现有目录）；能拿到上游重新发布的修复版。
+investment_data 自己的 README 也给出了一套严谨的手动流程：下载发布清单（manifest），用 `qlib/validate_archive.py --require-publishable` 校验数据包，再解压。qlib-sync 每次更新都直接运行这个校验器：用的是未经修改的原文（来自 [commit 68fdc66](https://github.com/chenditc/investment_data/blob/68fdc66b109459e522050c94723684525aea23ab/qlib/validate_archive.py)，Apache-2.0 协议），下载前校验 manifest，下载后校验数据包。我们有一组测试，把同样的坏数据分别交给上游脚本和 qlib-sync，要求两边结论完全一致；每周还有自动任务检查上游是否修改了校验器。
+
+在此之外，qlib-sync 补上了手动流程做不到的部分：没有新数据时不下载；把 manifest 和数据包锁定在同一个发布版本；在旧数据旁边解压，通过后整体切换、失败回滚（而不是直接解压覆盖到现有目录）；能拿到上游重新发布的修复版。
 
 qlib-sync 把本地数据当生产系统来管理：
 
@@ -38,15 +41,17 @@ qlib-sync 把本地数据当生产系统来管理：
 
 | 步骤 | 做什么 |
 |---|---|
-| 检查 | 先读发布附带的 500 字节 manifest。已是最新就结束，不下载 |
+| 检查 | 锁定最新发布的版本号，读取它附带的 500 字节 manifest。已是最新就结束，不下载 |
 | 下载 | 支持断点续传、显示进度；网络慢时可走镜像 |
-| 校验 | 核对大小和 sha256；执行与上游 `validate_archive.py` 相同的发布检查（各指数成分和未来交易日历都与 manifest 日期一致、发布标记为可发布）；解压前检查路径和链接是否安全 |
+| 校验 | 运行 investment_data 自己的 `validate_archive.py --require-publishable`（原文未改）：manifest 字段和格式、大小和 sha256、所有必需的交易日历和指数成分、日期格式、排序、未来交易日历。它拒绝的一律不装 |
 | 准备 | 解压到旧数据旁边的临时目录；拒绝降级 |
 | 切换 | 把新数据换上去，再用 Qlib 实际读一次 |
 | 回滚 | 切换后任何一步失败，自动换回旧数据 |
 | 汇报 | 新增了哪些交易日、新上市和退市的股票 |
 
-这些校验能挡住损坏、不完整或被篡改的数据包，**挡不住上游正常发布的数据里本身的数值错误**（比如 #163 那种）。需要防这类问题时，可以加 `--keep-backup` 保留一份可回滚的旧数据。
+**默认必须通过校验。** manifest 缺失、读不了或被校验器拒绝时，更新会停止，原有数据保持不变。`--allow-unverified` 可以在 manifest 无法校验时仍然安装，此时结果和安装记录都会标明“未校验”；但如果 manifest 有效而数据包的校验值对不上，无论如何都会拒绝。
+
+这些校验能挡住损坏、不完整、被篡改或格式不对的数据包，**挡不住上游正常发布的数据里本身的数值错误**（比如 #163 那种）。需要防这类问题时，可以加 `--keep-backup` 保留一份可回滚的旧数据。
 
 ## 命令
 
@@ -67,6 +72,7 @@ qlib-sync cn restore --list       # 查看备份；restore --yes 换回备份
 | `--keep-backup` | 保留一份旧数据用于回滚 |
 | `--protect 文件名` | 更新后保留 `instruments/` 里自定义的股票池文件（可重复使用） |
 | `--force` | 日期相同也重新安装 |
+| `--allow-unverified` | manifest 无法校验时仍然安装（会标明未校验；校验值不符仍会拒绝） |
 
 **注意：更新会替换整个 `cn_data` 目录。** 你自己放进去的文件，除非用 `--protect` 指定，否则会丢失。
 
@@ -99,17 +105,17 @@ MCP server 在你本机运行，读取你电脑上的数据，不需要搭建任
 | 工具 | 接入方式 |
 |---|---|
 | Claude Desktop | 从[最新发布](https://github.com/randyy179/qlib-sync/releases/latest)下载 `qlib-sync.mcpb`，双击安装 |
-| Claude Code | `claude mcp add qlib-sync -- uvx qlib-sync mcp` |
-| OpenAI Codex CLI | `codex mcp add qlib-sync -- uvx qlib-sync mcp` |
+| Claude Code | `claude mcp add qlib-sync -- uvx --python 3.12 qlib-sync mcp` |
+| OpenAI Codex CLI | `codex mcp add qlib-sync -- uvx --python 3.12 qlib-sync mcp` |
 | 腾讯 CodeBuddy、字节 Trae、阿里通义灵码 | 在 MCP 设置里手动添加服务器，粘贴下面的 JSON |
-| Cherry Studio | 设置 → MCP 服务器 → 添加：类型选 STDIO，命令填 `uvx`，参数分两行填 `qlib-sync` 和 `mcp` |
+| Cherry Studio | 设置 → MCP 服务器 → 添加：类型选 STDIO，命令填 `uvx`，参数分四行填 `--python`、`3.12`、`qlib-sync`、`mcp` |
 | 通义千问 Qwen Code | 把下面的 JSON 写进 `~/.qwen/settings.json` |
 | Cursor | 把下面的 JSON 写进 `~/.cursor/mcp.json` |
 | Gemini CLI | 把下面的 JSON 写进 `~/.gemini/settings.json` |
-| VS Code（Copilot Agent 模式） | `.vscode/mcp.json`：`{ "servers": { "qlib-sync": { "type": "stdio", "command": "uvx", "args": ["qlib-sync", "mcp"] } } }` |
+| VS Code（Copilot Agent 模式） | `.vscode/mcp.json`：`{ "servers": { "qlib-sync": { "type": "stdio", "command": "uvx", "args": ["--python", "3.12", "qlib-sync", "mcp"] } } }` |
 
 ```json
-{ "mcpServers": { "qlib-sync": { "command": "uvx", "args": ["qlib-sync", "mcp"] } } }
+{ "mcpServers": { "qlib-sync": { "command": "uvx", "args": ["--python", "3.12", "qlib-sync", "mcp"] } } }
 ```
 
 各工具的菜单名称和配置文件位置会随版本变化，找不到时以该工具的 MCP 官方文档为准。已实测：Claude Code、OpenAI Codex CLI。

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/mcpb/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.4",
   "name": "qlib-sync",
   "display_name": "qlib-sync: China A-share data",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Install, update, and read a local Qlib China A-share daily dataset.",
   "long_description": "Keeps ~/.qlib/qlib_data/cn_data current with the daily community release from chenditc/investment_data, with checksum verification and automatic rollback, and lets Claude read daily prices and index constituents from it. The first update downloads about 550 MB.",
   "author": {

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/mcpb/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "qlib-sync-mcpb"
-version = "0.1.0"
+version = "0.2.0"
 description = "Claude Desktop bundle for qlib-sync"
 requires-python = ">=3.10,<3.13"
-dependencies = ["qlib-sync==0.1.0"]
+dependencies = ["qlib-sync==0.2.0"]

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qlib-sync"
-version = "0.1.0"
+version = "0.2.0"
 description = "Safely install and update a local Qlib China A-share dataset, with an MCP server for AI assistants."
 dynamic = ["readme"]
 requires-python = ">=3.10,<3.13"

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/server.json

@@ -7,15 +7,22 @@
     "url": "https://github.com/randyy179/qlib-sync",
     "source": "github"
   },
-  "version": "0.1.0",
+  "version": "0.2.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "qlib-sync",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "runtimeHint": "uvx",
-      "packageArguments": [{ "type": "positional", "value": "mcp" }],
-      "transport": { "type": "stdio" },
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "mcp"
+        }
+      ],
+      "transport": {
+        "type": "stdio"
+      },
       "environmentVariables": [
         {
           "name": "QLIB_SYNC_DATA_DIR",
@@ -27,6 +34,13 @@
           "description": "Optional prefix-style GitHub proxy for slow connections, e.g. https://ghfast.top",
           "isRequired": false
         }
+      ],
+      "runtimeArguments": [
+        {
+          "type": "named",
+          "name": "--python",
+          "value": "3.12"
+        }
       ]
     }
   ]

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/skills/qlib-sync/SKILL.md

@@ -6,15 +6,16 @@ description: Install, update, check, and read the local Qlib China A-share daily
 # qlib-sync
 
 qlib-sync keeps `~/.qlib/qlib_data/cn_data` (Qlib's default A-share location) in step with the
-daily community release from chenditc/investment_data. Every update is transactional: the new
-package is verified (sha256 from the release manifest) and validated in a staging directory,
-swapped in, and checked with a real Qlib read. On any failure the previous data is restored,
-so running an update is always safe.
+daily community release from chenditc/investment_data. Every update is transactional: the
+release is pinned by tag, checked with the dataset maintainers' own `validate_archive.py
+--require-publishable` (an unmodified copy ships with qlib-sync), staged, swapped in, and checked
+with a real Qlib read. A release that cannot be verified is refused, and on any failure the
+previous data is restored, so running an update is always safe.
 
 ## Pick the interface
 
 - **MCP tools available** (`cn_status`, `cn_update`, `cn_get_prices`, ...): use them directly.
-- **Otherwise** use the CLI. If `qlib-sync` is not installed, `uvx qlib-sync ...` runs it
+- **Otherwise** use the CLI. If `qlib-sync` is not installed, `uvx --python 3.12 qlib-sync ...` runs it
   without installing; `pip install qlib-sync` installs it. Confirm before installing anything.
 
 ## Update the data
@@ -37,8 +38,9 @@ Read the `[ERROR]` line. The existing data is unchanged in every failure case.
 | Message contains | Meaning | What to do |
 |---|---|---|
 | `could not download` | Network problem reaching GitHub | Retry with a mirror: `qlib-sync cn update --mirror https://ghfast.top` (or set `QLIB_SYNC_MIRROR`). Common in mainland China. |
-| `sha256 does not match` | Corrupt or tampered download; it was discarded | Run the update again. If it repeats, the release itself may be broken; wait for the next one. |
-| `manifest says` | Package contents disagree with the release metadata | Upstream problem. Wait and retry later; do not use `--force`. |
+| `refusing to install unverified data` | The release manifest could not be read or was rejected | Usually a network problem: retry, or add `--mirror`. If the message names `invalid-manifest`, upstream published something its own validator rejects; wait for the next release. |
+| `upstream validator (archive-identity-mismatch)` | Corrupt or tampered download; it was discarded | Run the update again. If it repeats, the release itself may be broken; wait for the next one. |
+| `upstream validator (` any other reason | The package fails the maintainers' own checks | Upstream problem. Wait and retry later; do not use `--force` or `--allow-unverified`. |
 | `refusing downgrade` | The release is older than the local data | Nothing to do; local data is newer. |
 | `already running` | Another update holds the lock | Wait for it. If none is running (a crash left the lock), remove `~/.qlib/qlib_data/.cn_data_update.lock` after confirming with the user. |
 | `not a Qlib daily dataset` | The target folder has other content | Ask the user; never delete it yourself. Use `--data-dir` to install elsewhere. |
@@ -50,6 +52,8 @@ After any repair, run `qlib-sync cn health-check`; it ends with `passed` or list
 - The update replaces the whole `cn_data` folder. Files the user added there are lost unless
   passed with `--protect FILE` (custom stock pools in `instruments/`). Mention this before the
   first update if they have customized the folder.
+- Only suggest `--allow-unverified` if the user explicitly accepts installing data nobody has
+  checked; it never bypasses a checksum mismatch, and the result is marked unverified.
 - `--keep-backup` keeps the previous dataset for one rollback; `qlib-sync cn restore --list`
   shows backups and `restore --yes` switches back. Restoring replaces the active data, so
   confirm with the user first.

{qlib_sync-0.1.0 → qlib_sync-0.2.0}/src/qlib_sync/__init__.py

@@ -8,6 +8,6 @@ os.environ.setdefault("MLFLOW_DISABLE_AGENT_HINT", "1")
 from .api import health_check_cn, status_cn, update_cn
 from .cn.update import UpdateError, UpdateResult
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 __all__ = ["UpdateError", "UpdateResult", "health_check_cn", "status_cn", "update_cn", "__version__"]

qlib_sync-0.2.0/src/qlib_sync/_upstream/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

qlib_sync-0.2.0/src/qlib_sync/_upstream/__init__.py

@@ -0,0 +1,14 @@
+"""Code from chenditc/investment_data, used unmodified.
+
+`validate_archive.py` is the release validator from
+https://github.com/chenditc/investment_data/blob/68fdc66b109459e522050c94723684525aea23ab/qlib/validate_archive.py
+licensed under the Apache License 2.0 (see LICENSE in this folder). It is kept byte-for-byte
+identical so qlib-sync applies exactly the checks the dataset's maintainers apply, and so a
+change upstream can be detected by comparing git blob hashes.
+"""
+
+SOURCE_REPOSITORY = "chenditc/investment_data"
+SOURCE_PATH = "qlib/validate_archive.py"
+SOURCE_COMMIT = "68fdc66b109459e522050c94723684525aea23ab"
+# `git hash-object` of validate_archive.py; equal to the blob sha GitHub reports for SOURCE_PATH.
+SOURCE_BLOB_SHA = "f7141a3969ff1fb9e448cf753ed3ffde017afaa3"