fix(mirror): replace embeddable Windows Python with full builds

.github/workflows/mirror-sync.yml

@@ -37,6 +37,11 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Install msitools
+        # Full Windows Python builds are assembled from python.org's MSIs
+        if: matrix.runtime == 'python'
+        run: sudo apt-get update && sudo apt-get install -y msitools
+
       - name: Build mirror tool
         run: |
           cd scripts/mirror-binaries

.github/workflows/mirror-tool.yml

@@ -0,0 +1,45 @@
+name: Mirror Tool
+
+# Tests for scripts/mirror-binaries, which is its own Go module and so is
+# not covered by the Build & Test workflow.
+
+on:
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'scripts/mirror-binaries/**'
+      - '.github/workflows/mirror-tool.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'scripts/mirror-binaries/**'
+      - '.github/workflows/mirror-tool.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test mirror tool
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: scripts/mirror-binaries
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: 'scripts/mirror-binaries/go.mod'
+          cache-dependency-path: 'scripts/mirror-binaries/go.sum'
+
+      - name: Vet
+        run: go vet ./...
+
+      # Network tests (python_winbuild_network_test.go) only run when
+      # MIRROR_NETWORK_TESTS=1, so this needs neither network nor msitools.
+      - name: Test
+        run: go test -race ./...

CLAUDE.md

@@ -170,6 +170,7 @@ Maps to runtime provider → Resolves version
 | `internal/download/` | File downloads with progress |
 | `internal/manifest/` | Version manifest fetching and caching |
 | `internal/migration/` | Migration detection and helpers |
+| `internal/pth/` | Turns off the `._pth` file of python.org's embeddable Windows Python (installer and `dtvem doctor`) |
 | `internal/testutil/` | Shared test utility functions |
 | `internal/constants/` | Platform constants |
 | `src/cmd/` | CLI commands (one file per command) |
@@ -324,7 +325,10 @@ cd src && go test -cover ./...    # With coverage
 | `generate-manifests-from-r2.yml` | Manual/scheduled | Generate version manifests from R2 mirror |
 | `deploy-manifests.yml` | Push to main (manifests/) | Deploy manifest files to R2 |
 | `mirror-all.yml` | Manual dispatch | Mirror all runtime binaries to R2 |
-| `mirror-sync.yml` | Scheduled | Sync new versions to R2 mirror |
+| `mirror-sync.yml` | Scheduled | Sync new versions to R2 mirror (installs msitools for Python) |
+| `mirror-tool.yml` | PR, push to main (`scripts/mirror-binaries/`) | Vet and test the mirror tool, a separate Go module |
+
+**Windows Python builds in the mirror**: python-build-standalone is the first source. For versions it lacks, the mirror assembles full builds instead of using python.org's embeddable zips (`scripts/mirror-binaries/python_winbuild.go`): `windows-amd64` from python.org's per-component MSIs (verified against the pinned Windows signing key in `keys/`, unpacked with `msiextract`), `windows-arm64` from python.org's `pythonarm64` NuGet packages (verified against nuget.org's SHA-512). Both are packed as a `.tar.gz` with everything under `python/`. Builds that turn out not to be full installs are skipped, not published. `MIRROR_NETWORK_TESTS=1 go test -run Network ./...` (needs msitools) builds real archives.
 
 ### Reusable Workflows (from `dtvem/.github` repo)
 

scripts/mirror-binaries/go.mod

@@ -3,6 +3,7 @@ module github.com/CodingWithCalvin/dtvem.cli/scripts/mirror-binaries
 go 1.23.0
 
 require (
+	github.com/ProtonMail/go-crypto v1.5.2
 	github.com/aws/aws-sdk-go-v2 v1.32.6
 	github.com/aws/aws-sdk-go-v2/config v1.28.6
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.47
@@ -24,4 +25,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 // indirect
 	github.com/aws/smithy-go v1.22.1 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
 )

scripts/mirror-binaries/go.sum

@@ -1,3 +1,5 @@
+github.com/ProtonMail/go-crypto v1.5.2 h1:cucYnvqcY7UOXVD//mSyjeaPY0SSN3v5cDkYPxumINk=
+github.com/ProtonMail/go-crypto v1.5.2/go.mod h1:/RaSu30DaKO4RY+XdV/ACcCcZkGr7AhUIduq5sjzzCo=
 github.com/aws/aws-sdk-go-v2 v1.32.6 h1:7BokKRgRPuGmKkFMhEg/jSul+tB9VvXhcViILtfG8b4=
 github.com/aws/aws-sdk-go-v2 v1.32.6/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 h1:lL7IfaFzngfx0ZwUGOZdsFFnQ5uLvR0hWqqhyE7Q9M8=
@@ -34,3 +36,9 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 h1:s4074ZO1Hk8qv65GqNXqDjmkf4HS
 github.com/aws/aws-sdk-go-v2/service/sts v1.33.2/go.mod h1:mVggCnIWoM09jP71Wh+ea7+5gAp53q+49wDFs1SW5z8=
 github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
 github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=