Introduction
BenchTicket's approved versions are now known, but a distribution with the same name and version can still contain different code. This independent environment includes a correct source, controlled replacements, and a separate approval catalogue.
You will make the installation recipe accept exact approved bytes, reject changes to direct or indirect dependencies, and continue working with a legitimate mirror. The commands build on the first guided lab. All wheels are synthetic; no public package service or vulnerability exploit is involved.
See Why the Version Label Is Not Enough
In this step, you will compare a correct example with a same-version replacement. Start in Terminal:
cd /home/labex/project/ticket-build
/opt/labex-lookalike/demo
The normal T101 amount is 3200,32.00. The saved requirements already pin prices 1.4.0 and labels 1.0.0. This lab's installer accepts two arguments: the target environment and a wheel directory. --no-index disables index lookup; --find-links searches the supplied directory.
Create a disposable demonstration environment:
python3 -m venv --without-pip .trial
bash install.sh .trial '/opt/labex-lookalike/sources/changed direct'
The quotes preserve spaces in that one path argument. Both versions still match the catalogue:
python3 -m pip --isolated --python .trial show benchticket-prices benchticket-labels
.trial/bin/python quote.py orders.csv
T101 now costs 3300,33.00. This supplied replacement has a valid wheel structure and unchanged metadata; only its code differs. The name and version did not bind the expected bytes.
Compare Candidate Bytes with Independent Approval
In this step, you will distinguish measuring a file from approving it. SHA-256 produces a digest for exact bytes; a different digest means a different file.
Read the separately supplied catalogue:
cat /opt/labex-lookalike/approval/packages.tsv
pip hash measures a wheel. Measure the approved file:
python3 -m pip hash /opt/labex-lookalike/sources/approved/benchticket_prices-1.4.0-py3-none-any.whl
Its digest matches the catalogue. Measure the same-name replacement:
python3 -m pip hash '/opt/labex-lookalike/sources/changed direct/benchticket_prices-1.4.0-py3-none-any.whl'
That digest differs. Computing this new hash does not make the replacement approved. The training assumption is that the project-independent catalogue arrived through a trusted review channel; hashes alone do not identify a publisher.
Both prices and labels must be constrained. Otherwise a changed indirect dependency could alter the displayed amount while the prices package stays unchanged.
Constrain the Complete Dependency Set
In this step, you will save the reviewed bytes as pip requirements. Keep each version and its --hash=sha256: value on the same line:
cat > requirements.txt <<'EOF'
benchticket-prices==1.4.0 --hash=sha256:db50f7ff915dcc6cbdbf5b0afe2be55849ee70a8c7b55c44b1b3dab5deb806f9
benchticket-labels==1.0.0 --hash=sha256:3b3d881be08017aee54a825aaf3da158cd0b00b69f6d3f89744e8473f879baef
EOF
--require-hashes demands pinned, hashed requirements for the complete dependency set, including indirect packages. --force-reinstall also replaces an already installed same-version package, so a prior trial cannot be mistaken for a fresh check.
cat > install.sh <<'EOF'
#!/bin/bash
set -e
python3 -m pip --isolated --python "$1" install --force-reinstall --require-hashes --no-cache-dir --no-index --find-links "$2" -r requirements.txt
EOF
Keep requirements.txt relative to the current project directory so the two recipe files can travel together. Targets belong to the caller; no sudo is needed. Keep both quoted arguments: the first chooses the environment; the second chooses the supplied wheel directory. The recipe must actually use that second directory, rather than silently retrieving a different source. It should accept any supplied copy of the approved wheels and reject changed bytes.
A typo in a hash should stop installation. Compare with the independent catalogue and correct the requirement; do not replace approval with a digest copied from the failing candidate.
Build and Deliver the Approved Prices
In this step, you will use the corrected recipe in your main environment. Create it separately from the earlier trial:
python3 -m venv --without-pip .venv
bash install.sh .venv /opt/labex-lookalike/sources/approved
Both approved packages should install. Produce the real handover:
.venv/bin/python quote.py orders.csv --output handover.csv
cat handover.csv
Expect the original IDs and quantities with totals 3200, 1200, 1600, 0, and 4200 cents. Check the whole file:
diff -u /opt/labex-lookalike/approval/reference.csv handover.csv
No output means a match. This tests both computation and labels; merely seeing two installed versions would miss altered code. If an earlier accidental installation used changed bytes, this recipe's forced reinstall restores approved code when given the approved source. Keep the original consumer and orders untouched.
Reject a Changed Indirect Dependency
In this step, you will test rejection without damaging the working price list. The changed indirect directory contains approved prices but a same-version replacement labels package.
python3 -m venv --without-pip .blocked
The next installation is expected to fail with a hash mismatch and exit status 1:
bash install.sh .blocked '/opt/labex-lookalike/sources/changed indirect'
Pip reports THESE PACKAGES DO NOT MATCH THE HASHES and shows the expected and received digest for labels. Read the native status immediately:
echo $?
Expect 1. A connection failure, missing path or missing interpreter is a different error and does not demonstrate hash rejection. If a path was mistyped, return to ticket-build, list its entries with ls, and repeat this disposable test.
The failed install may leave a partial .blocked environment; it is not a deliverable. Your good .venv and handover.csv must remain usable:
.venv/bin/python quote.py orders.csv
Expect the correct five rows. Never weaken the trusted hash list just to make the rejected source install.
Accept an Unchanged Mirror
In this step, you will prove the recipe still permits legitimate builds. A mirror is another location holding the same approved files; its path has spaces to exercise the quoted arguments.
python3 -m venv --without-pip '.mirror environment'
bash install.sh '.mirror environment' '/opt/labex-lookalike/sources/approved mirror'
'.mirror environment/bin/python' quote.py orders.csv
Expect all five correct orders again. Refusing every source, ignoring the supplied source argument, or relying on an existing environment would not meet this contract.
Your deliverables are the saved installation recipe, complete hashed requirements, actual main environment and correct handover.csv. The trial environments are only controlled demonstrations. A new dependency or approved release needs a new review of its bytes; automatically adding whatever hash a source reports would remove the protection.
This exercise establishes the boundary for the supplied original wheels. It does not prove that an approved package contains no vulnerability or that the entire build is reproducible on every platform.
Summary
You distinguished version metadata from exact distribution bytes, constrained direct and indirect dependencies, and rejected same-version replacements. The original ticket tool still produces every correct order, and an unchanged mirror remains usable. The independent approval catalogue is the trust input; the candidate package does not approve itself.
