03:00:0050% OFFClaim
MiniMax H3

Hands-on recipe

Audit a delivery package for missing, extra and changed files

Establish whether a received package has exactly the expected local regular files and byte contents. A checksum manifest detects change relative to a trusted copy; it is not an authenticity signature or media-quality check.

Includes executed local fixtures, scripts and receipts. These checks do not represent a video-generation service run.

Get the practice files ↓
Original task-specific local-fixture diagram
Original three-file delivery fixture, executed missing/extra/changed-file cases and a checksum audit diagram. No media or model quality claim.

01Prepare environment and inputs

  1. Use Node.js with built-in filesystem and crypto modules. The original delivery folder contains delivery-notes.txt, shots.json and captions.srt.
  2. Inspect delivery-manifest.json outside the delivery/ folder. Its three rows bind basename, byte count and SHA-256; excluding the manifest itself avoids a circular self-hash.
  3. Choose a new output directory and preserve the expected manifest separately from any editable received files. The supplied fixture totals 171 bytes before receipts and documentation.

02Run the recipe

Run command

node run-recipe.mjs --out ./my-run

  1. Freeze the expected file inventory

    The script writes an original miniature handoff and captures its sorted filename list, byte sizes and SHA-256 values. The expected set is exact: an additional file is reviewable evidence of a mismatch rather than something silently skipped.

  2. Require safe regular files

    Validate unique safe basenames, compare expected and actual inventories, then use lstat to reject a symlink before reading contents. This fixture audits one flat directory, not an arbitrary nested archive or a concurrent untrusted filesystem.

  3. Check sizes and full byte hashes

    For each expected file, compare both size and SHA-256. The same-size mutation flips one byte of delivery-notes.txt, proving that size alone is insufficient. SHA-256 proves equality to this expected manifest, not that its author is trusted.

  4. Restore and rerun the handoff audit

    The suite temporarily removes a file, adds an extra file, changes bytes and replaces a file with a symlink, always restoring originals in finally. It also rejects duplicate manifest paths and ../outside.txt. The restored package passes again, with nine checks retained.

03Check the result

  • The clean delivery folder contains exactly the three declared regular files.
  • Every expected SHA-256 is a 64-character lowercase hexadecimal digest.
  • A missing file and an unexpected extra file are separately rejected.
  • A one-byte change that preserves file size fails its checksum comparison.
  • Duplicate manifest paths, a parent path and a symlink are rejected.
  • After the negative fixtures are restored, the complete package passes again; all nine checks pass.

04Troubleshoot and deliver

All byte sizes match but the audit fails.

Compare the actual SHA-256 of the named file with its expected row; restore the correct bytes instead of removing the hash check.

An extra export appears in the package.

Decide whether that file belongs in the handoff. Remove only the accidental file, or deliberately revise the expected manifest and have it reviewed.

A shortcut or symlink is rejected.

Replace only that entry with a real local regular file, then capture the intended file’s bytes and rerun inventory plus SHA-256 checks.

Keep a trusted manifest and the actual audit receipt with the handoff. The audit does not decode video, establish authorship or protect a manifest that was itself replaced by an attacker.

05Download scripts and fixtures

Reference documentation