mix localize.verify_locales (Localize v1.4.0)

Copy Markdown View Source

Verifies a directory of locale ETF files against the SHA-256 manifest bundled with this release of Localize.

Localize verifies every downloaded locale file against priv/localize/locale_hashes.etf before decoding it, so a file whose bytes do not match is refused at download time. This task runs the same check ahead of time, over files already on disk, and names the ones that differ.

The manifest pins more than transport integrity: it pins the data to the shape this release's accessors were written against. A locale file built from a different CLDR release, or by a pipeline from a different Localize version, hashes differently even when it decodes cleanly — and loading it surfaces much later as a missing key deep inside a formatting call. That is why the hashes are not overridable, and why this task reports the CLDR repository tag the reference files were generated from: a file that does not verify can be rebuilt from, or replaced by, data from that exact tag.

Usage

mix localize.verify_locales

Verifies the configured locale cache directory, the one Localize.Locale.Provider.locale_cache_dir/0 returns and mix localize.download_locales writes to.

mix localize.verify_locales path/to/locales

Verifies the given directory instead.

mix localize.verify_locales --quiet

Reports only the files that fail, and the summary, which suits a CI step.

Output

The report opens with the provenance of the manifest it checks against — this build's Localize and CLDR versions, the CLDR repository tag the reference data was generated from, and the CDN those reference files are published to:

Localize version:  1.3.0
CLDR version:      49.0.0
CLDR repo tag:     release-49
Reference CDN:     https://elixir-localize.com/locales/v49.0.0

Each .etf file in the directory is then one of:

  • ok — the bytes match the manifest entry for that locale.

  • MISMATCH — the locale is in the manifest but the bytes differ. The file was not produced by the pipeline this release was built from.

  • NOT IN MANIFEST — no manifest entry exists for the file's locale, so the file is not a locale this release knows.

Manifest entries with no corresponding file are counted but not listed: a cache holding only the locales an application configured is the normal case.

Exit status

Exits 0 when every file verifies, and non-zero when any file mismatches or is absent from the manifest, so the task can gate a build.

Mirroring the reference files

A deployment that must not reach the Localize CDN at build time can mirror the published files rather than rebuild them. mix localize.download_locales writes verified copies into the cache directory, which can then be committed, cached, or served from elsewhere via :locale_base_url. Because the bytes are the published bytes, this task and the runtime check both pass unchanged.