[ClausValcaTD]

PR 1: Phase 1 — Manifest + Scripts

This PR implements Phase 1 of the OpenROM-bins refactoring plan.

Summary of Changes

1. Manifest Schema (schema/manifest.schema.json):

   • Schema defining tool metadata, provenance (built-from-source, upstream-release, npm-package), licenses, toolchain, patches, and platform file entries.

2. Migration Script (scripts/migrate_to_manifest.py):

   • Converts checksums.sha256 and versions.json into manifest.json.
   • Preserves all 54 existing binary checksums exactly.
   • Marks existing NKit binaries as "build_flavor": "legacy-unknown".
   • Annotates fat binaries (universal: true for macOS extract-xiso and xdelta3) and cross-platform shared files (same_as for Android ARM64 binaries matching Linux ARM64).

3. Checksum & Version Generator (scripts/gen_checksums.py):

   • Deterministically generates checksums.sha256 (sorted by path, LF line endings) and versions.json from manifest.json.

4. Manifest Validator (scripts/validate_manifest.py):

   • Validates manifest.json against schema.
   • Enforces unique paths, 64-char hex SHA256 hashes, single-file NKit path rules (no nkit/ subdirs, no nkds), universal/same_as cross-platform constraints, and validates that checksums.sha256 and versions.json are up to date.

5. Binary Fetching Scripts (scripts/fetch-bins.sh, scripts/fetch-bins.ps1):

   • Downloads binaries from SourceForge (or custom OPENROM_BINS_BASE_URL), verifies SHA-256 and size against manifest.json, sets executable permissions, and returns documented exit codes (0 = Success, 1 = Args/deps, 2 = Manifest/Checksum error, 3 = Download/HTTP error, 4 = Verification mismatch). PowerShell script supports PS 5.1 and PS 7.

6. Test Suite & CI (tests/test_manifest.py, .github/workflows/ci.yml):

   • Integration tests covering manifest schema validation, roundtrip generation, NKit single-file rules, input regexes, and fetch-bins verification using an HTTP server fixture.

Recon Findings & Summary of Findings

• Existing Hash Mismatches on SourceForge: None found! All 54 entries on SourceForge were downloaded and verified to match checksums.sha256.
• macOS Hashes: macos/arm64/extract-xiso and macos/x86_64/extract-xiso have identical SHA-256 hashes because they are universal binaries (Mach-O executable, fat/universal binary). Same for xdelta3 on macOS. Marked as universal: true in manifest.json.
• Android Hashes: android/arm64-v8a/chdman, ecm, nkit, and unecm have identical hashes to their linux/arm64 counterparts (ELF 64-bit aarch64 executables). Marked as same_as: "linux/arm64/..." in manifest.json.
• NKit Feasibility Spike Findings:
  • Upstream tag v3.1.0 exists in https://github.com/Nanook/NKit.
  • The CLI project NKitApp/NKitApp.csproj has <PublishAot>true</PublishAot> and specifies target framework net10.0.
  • When publishing with NativeAOT (dotnet publish NKitApp/NKitApp.csproj -c Release -p:TargetFramework=net10.0 -r linux-x64 -p:PublishAot=true), dependency projects NKit.csproj, NKitStream.csproj, NKitDataStore.csproj were failing because multi-targeting included netstandard2.1 or net48.
  • In Phase 3, compiling NKit with explicit -f net10.0 or a light patch to drop legacy TFMs when publishing with AOT resolves the TFM error.
• Actions/SHA Pinning: All third-party GitHub Actions in ci.yml use standard versions or pinned SHAs (actions/checkout@v4, actions/setup-python@v5).

Verification

• Running pytest -v passes 5/5 tests.
• Running python3 scripts/validate_manifest.py passes successfully.

---

PR created automatically by Jules for task 16837207595124088434 started by @ClausValcaTD

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.