diff --git a/packages/syft-permissions/src/syft_permissions/spec/ruleset.py b/packages/syft-permissions/src/syft_permissions/spec/ruleset.py index d10e7ba6c54..47e4e9ec188 100644 --- a/packages/syft-permissions/src/syft_permissions/spec/ruleset.py +++ b/packages/syft-permissions/src/syft_permissions/spec/ruleset.py @@ -1,3 +1,4 @@ +import hashlib from pathlib import Path import yaml @@ -15,6 +16,14 @@ class RuleSet(BaseModel): @classmethod def load(cls, filepath: Path) -> "RuleSet": + hash_path = filepath.with_suffix(filepath.suffix + ".sha256") + if hash_path.exists(): + with open(hash_path) as hf: + expected_hash = hf.read().strip() + with open(filepath, "rb") as f: + actual_hash = hashlib.sha256(f.read()).hexdigest() + if actual_hash != expected_hash: + raise ValueError(f"File integrity check failed for {filepath}") with open(filepath) as f: data = yaml.safe_load(f) or {} rs = cls.model_validate(data) @@ -26,3 +35,6 @@ def save(self, filepath: Path | None = None) -> None: data = self.model_dump(mode="json") with open(target, "w") as f: yaml.safe_dump(data, f, default_flow_style=False) + hash_data = hashlib.sha256(target.read_bytes()).hexdigest() + with open(target.with_suffix(target.suffix + ".sha256"), "w") as hf: + hf.write(hash_data)