[magnusp]

Fixes #115

Vendored checksums vouched for themselves: an edit could weaken a vendored file and rewrite both hash lines, and --verify still passed. This PR ties every # upstream hash to the blob at the pinned commit.

Contract: Hrana 3 is the source of truth for transport and data; java.sql is the source for the JDBC surface; xerial/sqlite-jdbc is a behavioral reference only. This change is protocol-neutral vendoring/CI tooling and touches no driver or protocol code.

What changed

• tools/export-upstream --verify-pinned runs --verify, resolves the tag in .export-upstream to the pinned sha, and fetches each manifest blob at that commit with gh api (raw media type). A recorded upstream hash that differs fails and names the file.
• --verify now requires both the # upstream line and the current hash line for every manifest path. A manifest path with no entry fails.
• sha256_check runs --strict, so a malformed checksum line fails instead of warning, and failed file names are printed.
• Directory manifest entries append find output to manifest.paths instead of printing to stdout.
• .github/workflows/ci.yml runs --verify-pinned with GH_TOKEN.
• --self-test gains cases for a path with no checksum entry, a missing upstream line, a missing current line, a malformed line, a directory entry, and a tampered file whose both hashes are rewritten. That last case must fail and name the file. EXPORT_UPSTREAM_PINNED_TREE lets the pinned self-test run offline.

Red before the fix (base ba3f2e7)

• Manifest path with no checksum entry: Verified upstream-xerial_sqlite-jdbc ... (exit 0).
• Malformed checksum line: sha256sum: WARNING: 1 line is improperly formatted, then Verified ... (exit 0).
• Vendored file plus both hash lines rewritten: --verify exit 0.
• Directory manifest entry emitted find output to stdout rather than adding it to manifest.paths.

Green at head 61c9809

• --self-test: Self-test passed.
• --verify: passes.
• --verify-pinned: passes against cab7981c19ce04d691f0675f0b2586afc2bbf803.
• Rewritten file plus both hash lines: --verify passes, --verify-pinned fails naming src/test/java/org/sqlite/FetchSizeTest.java.
• Lane 1: conformance verify BUILD SUCCESS at trunk and head.
• Lane 2: tampered vendored test fails and names the file.
• Lane 3/6: clean --verify passes.
• Lane 4: -pl libsql-conformance -am test BUILD SUCCESS.
• Lane 5: -Pxerial-control verify passes.
• Lane 7: spotless:check passes.
• Lane 8: -pl libsql-jdbc test BUILD SUCCESS, 264 tests.
• Lane 9: directory entry passes; missing checksum entry and malformed line fail with clear messages.
• Lane 10: full reactor test BUILD SUCCESS.
• Perf: -pl libsql-jdbc test median 2.06 s at trunk, 2.08 s at head (+1.0%, within the 10% rule).

Divergences

None. No protocol or JDBC behavior changes; the only behavior change is in the maintainer verifier and CI.

Logs are under /tmp/xerial-parity-i115/.