pkg-drift: detect surplus or missing packages in mirrors vs manifest #165

New Issue

kert · 2026-03-24T03:54:38Z

kert commented

2026-03-24 03:54:38 +00:00

Goal

A pipeline step that compares mirror contents against the manifest and reports drift: packages in the mirror but not in the manifest (surplus), or in the manifest but not in the mirror (missing).

Scope

Script: dev/scripts/pkg_drift.py
Queries each mirror for its package list
Compares against data/pkg-manifest.json
Reports: {"surplus": {"apt": [...], "apk": [...], "pypi": [...]}, "missing": {...}}
Exit code 0 = no drift, exit code 1 = drift detected
Runs as CI step and as a scheduled job (e.g. daily)

Acceptance

Correctly detects when a package is added to Dockerfile but not mirrored
Correctly detects when a mirrored package is no longer referenced
Zero drift on a clean state after mirror sync

## Goal A pipeline step that compares mirror contents against the manifest and reports drift: packages in the mirror but not in the manifest (surplus), or in the manifest but not in the mirror (missing). ## Scope - Script: `dev/scripts/pkg_drift.py` - Queries each mirror for its package list - Compares against `data/pkg-manifest.json` - Reports: `{"surplus": {"apt": [...], "apk": [...], "pypi": [...]}, "missing": {...}}` - Exit code 0 = no drift, exit code 1 = drift detected - Runs as CI step and as a scheduled job (e.g. daily) ## Acceptance - [ ] Correctly detects when a package is added to Dockerfile but not mirrored - [ ] Correctly detects when a mirrored package is no longer referenced - [ ] Zero drift on a clean state after mirror sync

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-03-24 03:54:38 +00:00

kert added the quality ci labels 2026-03-24 03:54:38 +00:00

kert referenced this issue from a commit

2026-03-24 03:58:33 +00:00

add package supply chain scaffold: inventory scanner, drift detector, pipeline spec

kert closed this issue

2026-03-24 04:35:00 +00:00

kert referenced this issue

2026-03-24 04:35:35 +00:00

feat: package supply chain — inventory, mirrors, drift, vuln scanning #169

Sign in to join this conversation.