Genace
Sign inGet started

generated media upload integrity: verify the stored bytes before publication

A successful generation supplies an output reference, not evidence that your own object storage contains the same bytes. Build an integrity chain from download through staging, upload, and publication. A remote render can remain succeeded while one storage transfer needs repair; keep delivery status separate so a checksum failure never causes an automatic replacement render.

Identify the source output and staging file

Save the remote job ID and output index, then select the expected media type from the succeeded snapshot. The current Seedance adapter can return an empty metadata object, so do not assume a digest, measured size, or duration is already supplied. Compute your own staging evidence after downloading with bounded transport and destination policies.

import hashlib
from pathlib import Path

def file_evidence(filename: str) -> dict:
    digest = hashlib.sha256()
    count = 0
    with Path(filename).open("rb") as source:
        while chunk := source.read(1024 * 1024):
            digest.update(chunk)
            count += len(chunk)
    if count == 0:
        raise ValueError("Refuse an empty media file")
    return {"byte_length": count, "sha256": digest.hexdigest()}

This helper does not validate video structure; use a media decoder or inspector separately. A digest identifies the collected bytes. Without a trusted expected digest, it does not prove those bytes are the intended artistic result or that a truncated download is complete.

Use storage-supported integrity features

When your storage API supports an upload checksum, provide the algorithm and value required by that client and verify the service’s documented behavior. Retain the algorithm alongside the digest; a bare hexadecimal string is insufficient context for later comparison.

Do not universally interpret an ETag as the MD5 of the uploaded file. Multipart upload and storage configuration can change its meaning. Use documented checksum metadata or a verified read-back comparison when a strong byte comparison is required. This is a storage policy under your control, not an option accepted by Genace’s generation body.

Publish only after manifest reconciliation

Use a deterministic object key derived from your operation and output identity. Mark the artifact available only after upload and the durable manifest update succeed. If a worker stops after upload but before the manifest commit, the next attempt should inspect the existing object and finish reconciliation rather than create another generation.

Store source identity, staged byte length, staged digest, destination key, upload result, and verification time. Avoid putting signed source URLs in public analytics. They may carry temporary access credentials even though your Genace API key is absent.

Exercise failure boundaries offline

Create fixtures where the upload is truncated, the wrong staging file is selected, a multipart transfer is interrupted, and the destination object already exists. Verify the manifest remains unavailable until the expected checks pass. Test a crash between storage success and database commit and confirm recovery targets the same destination key.

For critical publication paths, read back a test object and compare its measured size and digest. Also test your media parser independently; matching storage bytes can still encode a corrupt or wrong-type file. These checks separate transport integrity from content quality and keep each recovery action scoped to the actual failure.

See output storage design, download validation, and corruption fixtures.

Continue with production operations

Where these facts come from