# `mix localize.verify_locales`
[🔗](https://github.com/elixir-localize/localize/blob/v1.4.0/lib/mix/tasks/localize.verify_locales.ex#L1)

Verifies a directory of locale ETF files against the SHA-256 manifest
bundled with this release of Localize.

Localize verifies every downloaded locale file against
`priv/localize/locale_hashes.etf` before decoding it, so a file whose bytes
do not match is refused at download time. This task runs the same check
ahead of time, over files already on disk, and names the ones that differ.

The manifest pins more than transport integrity: it pins the data to the
shape this release's accessors were written against. A locale file built
from a different CLDR release, or by a pipeline from a different Localize
version, hashes differently even when it decodes cleanly — and loading it
surfaces much later as a missing key deep inside a formatting call. That is
why the hashes are not overridable, and why this task reports the CLDR
repository tag the reference files were generated from: a file that does not
verify can be rebuilt from, or replaced by, data from that exact tag.

## Usage

    mix localize.verify_locales

Verifies the configured locale cache directory, the one
`Localize.Locale.Provider.locale_cache_dir/0` returns and
`mix localize.download_locales` writes to.

    mix localize.verify_locales path/to/locales

Verifies the given directory instead.

    mix localize.verify_locales --quiet

Reports only the files that fail, and the summary, which suits a CI step.

## Output

The report opens with the provenance of the manifest it checks against —
this build's Localize and CLDR versions, the CLDR repository tag the
reference data was generated from, and the CDN those reference files are
published to:

    Localize version:  1.3.0
    CLDR version:      49.0.0
    CLDR repo tag:     release-49
    Reference CDN:     https://elixir-localize.com/locales/v49.0.0

Each `.etf` file in the directory is then one of:

* `ok` — the bytes match the manifest entry for that locale.

* `MISMATCH` — the locale is in the manifest but the bytes differ. The file
  was not produced by the pipeline this release was built from.

* `NOT IN MANIFEST` — no manifest entry exists for the file's locale, so the
  file is not a locale this release knows.

Manifest entries with no corresponding file are counted but not listed: a
cache holding only the locales an application configured is the normal case.

## Exit status

Exits `0` when every file verifies, and non-zero when any file mismatches or
is absent from the manifest, so the task can gate a build.

## Mirroring the reference files

A deployment that must not reach the Localize CDN at build time can mirror
the published files rather than rebuild them. `mix localize.download_locales`
writes verified copies into the cache directory, which can then be committed,
cached, or served from elsewhere via `:locale_base_url`. Because the bytes are
the published bytes, this task and the runtime check both pass unchanged.

---

*Consult [api-reference.md](api-reference.md) for complete listing*