finprint.trust

module finprint

Which named-step code this machine recorded, so replay runs only that code without asking.

A recipe is a file anyone can edit, and its code_sha256 only proves the code matches a hash stored in the same file. So the trust check uses hashes held outside the recipe: every named step a session records adds its code hash to an in-process set and, on rec.save, to trusted_code in the folder FINPRINT_HOME (else the older UMP_RECIPE_HOME, else ~/.finprint; code trusted in the old default ~/.ump_recipe is still read). verify runs named-step code only when its hash is in one of those, or when the caller passes trust=True (finprint verify --trust) after reading the code. Writing the file is best effort: when the folder cannot be written the in-process set still covers verification in the same session.

Functions

store_path

function

def store_path() -> Path

Where this machine’s trusted code hashes are written.

Source: packages/finprint/src/finprint/trust.py, line 23

remember

function

def remember(hashes: Iterable[str | None], *, persist: bool = False) -> None

Source: packages/finprint/src/finprint/trust.py, line 37

is_trusted

function

def is_trusted(code_sha256: str | None) -> bool

Source: packages/finprint/src/finprint/trust.py, line 54