From dc14ccc56693f4622f86ea36255119196e470b54 Mon Sep 17 00:00:00 2001
From: Abdessamad Derraz <3028866+Abdess@users.noreply.github.com>
Date: Thu, 5 Nov 2026 19:48:12 +0100
Subject: [PATCH] fix: drop the .info md5 from the ecwolf profile

ecwolf.pk3 carried md5 c011b428, which its note said came from the .info.
The code checks no hash (src/wl_iwad.cpp:664-672) and the pk3 is built
from wadsrc/static/ at the pin, so no shipped file is designated by it.
The entry still resolves to the same file by name, and the platform lists
that pin this md5 are untouched.
---
 emulators/ecwolf.yml            |  3 +--
 tests/test_audit_regressions.py | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/emulators/ecwolf.yml b/emulators/ecwolf.yml
index 682135aaa..74ea8238c 100644
--- a/emulators/ecwolf.yml
+++ b/emulators/ecwolf.yml
@@ -47,11 +47,10 @@ files:
     required: true
     mode: standalone
     bundled: true
-    md5: "c011b428819eea4a80b455c245a5a04d"
     source_ref: "src/version.h:12 (MAIN_PK3), src/wl_iwad.cpp:664-672 (embedded open + fatal)"
     note: >
       Built from wadsrc/static/ via zipdir. Contains IWADINFO (game detection rules),
       palettes (wolfpal, spearpal, blakepal, noahpal), map lump remappers (wl6map,
       sodmap, etc.), DECORATE actor definitions, MAPINFO, SNDINFO, SNDSEQ, textures,
-      sprites, fonts, and localization strings. md5 from .info, not validated by code.
+      sprites, fonts, and localization strings. The code checks no hash.
       Shipped beside the executable in the Windows zip and in /usr/share/ecwolf by the .deb.
diff --git a/tests/test_audit_regressions.py b/tests/test_audit_regressions.py
index ab5a631be..a2fa111f3 100644
--- a/tests/test_audit_regressions.py
+++ b/tests/test_audit_regressions.py
@@ -5764,6 +5764,30 @@ class FsUaeKickstartIsFoundByContent(unittest.TestCase):
         self.assertNotIn("RetroPie launcher", entry.get("note", ""))
 
 
+class NoProfileHashFromASecondarySource(unittest.TestCase):
+    """ecwolf.yml pinned ecwolf.pk3 to an md5 its note said came from the
+    .info. The code checks none, and no file shipped at the pin carries it:
+    a source without a hash gives the profile none."""
+
+    PATTERN = re.compile(
+        r"(md5|sha1|crc32|hash)[^.]{0,40}\bfrom (the )?(\.info|core-?info|docs?|documentation)",
+        re.IGNORECASE,
+    )
+
+    def test_no_hashed_entry_names_a_secondary_source(self):
+        found = []
+        for path in sorted((ROOT / "emulators").glob("*.yml")):
+            profile = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+            for entry in profile.get("files") or []:
+                if not isinstance(entry, dict):
+                    continue
+                if any(entry.get(k) for k in ("md5", "sha1", "crc32", "sha256")) and (
+                    self.PATTERN.search(str(entry.get("note", "")))
+                ):
+                    found.append(f"{path.name}: {entry.get('name')}")
+        self.assertEqual(found, [])
+
+
 class AHashScanLabelNamesNoOtherDump(unittest.TestCase):
     """A core that finds its firmware by content names no file, so each
     entry name is a label. ares labelled its Famicom Disk System revision