
    Aj.              	         d Z ddlmZ ddlZddlZddlZddlZddlZddlm	Z	 ddl
mZmZ  ej                  d      ZdZdd	d
dddegZh dZdg g dZ ej&                   ej(                  edddd      j+                               j-                         ZddZd dZd!dZ	 	 	 	 	 	 d"dZd#dZd$dZd#dZd%dZdddddddd	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 d&dZ 	 	 	 	 	 	 d'dZ!y)(zICanonical pre-execution product derivation for Task26 candidate identity.    )annotationsN)Path)Mappingcastz^[0-9a-f]{64}$z3.12z	sealed-tycheckz'gateway/platforms/nutrition_coaching.pyz--output-formatgitlab--python-version>   final_statecommit_observerty_surface_gatefrozen_bootstraptelegram_adapterty_wheel_builderevidence_contractlocal_telegram_qaruntime_authoritysource_golden_pathty_hermetic_runnercandidate_derivationdualcoach_controllerinstalled_provenanceverify_source_golden_pathindependent_candidate_verifier)	root_modedirectoriesentriesFT,:ensure_ascii	sort_keys
separators	allow_nanc                R    t        j                  | dddd      j                         S )NFTr   r    )jsondumpsencode)values    /home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-combined-prefreeze-st_01a0198f-v36/gateway/platforms/task26_candidate_derivation.py	canonicalr+   9   s+    :: fh    c                   t        j                         }| j                  d      5 t        fdd      D ]  }|j	                  |        	 d d d        |j                         S # 1 sw Y   |j                         S xY w)Nrbc                 &     j                  d      S )Ni   )read)streams   r*   <lambda>zsha256_file.<locals>.<lambda>F   s    &++k":r,   r,   )hashlibsha256openiterupdate	hexdigest)pathdigestchunkr1   s      @r*   sha256_filer<   C   sh    ^^F	4F:C@EMM%  A 
  
 s   &A&&A>c                l    t        j                  t        t        |                   j	                         S N)r3   r4   r+   dictr8   )trust_boundarys    r*   trust_boundary_digestrA   K   s$    >>)D$89:DDFFr,   c                >   i d|dz  d|dz  d|dz  d|dz  d	|d
z  d|dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d|dz  d| d z  }t        |j                               D ci c]  \  }}|t        |       c}}S c c}}w )!Nr   z0gateway/platforms/task26_candidate_derivation.pyr   zgateway/commit_observer.pyr   z4gateway/platforms/dualcoach_tasks21_25_controller.pyr   z-gateway/platforms/task26_evidence_contract.pyr
   z'gateway/platforms/task26_final_state.pyr   z-gateway/platforms/task26_runtime_authority.pyr   zindependent_verify_candidate.pyr   zinstalled_wheel_provenance.pyr   ztask26_local_telegram_qa.pyr   ztask26_frozen_bootstrap.pyr   zsource_golden_path.pyr   ztask26_hermetic_ty_runner.pyr   z#task26_build_ty_executable_wheel.pyr   ztask26_ty_surface_gate.pyr   zgateway/platforms/telegram.pyr   zverify_source_golden_path.py)sorteditemsr<   )scripts_dirpackage_rootpathsnamer9   s        r*   qualification_tool_hashesrI   O   sg   
<!= 	<*FF 	
@!A	 	\
9: 	|&OO 	\
9: 	)+
++, 	.M M 	[+HH 	K*FF  	k,CC!" 	k,JJ#$ 	K*OO%& 	;)DD'( 	L+JJ)* 	$[3Q%Q+E. 7=U[[]6KL6K
dD+d##6KLLLs   ?Bc                   t        | t              rt        |       h dk7  rt        d      t	        t        t
        t        f   |       j                  d      }t        |t              rt	        t        t
        t        f   |      ni }j                  d      }t        |t              rt	        t        t
        t        f   |      ni d}j                  d      dk7  sۉj                  d      d	k7  st        fd
|D              st        j                  d            t        ust	        t        d         dk  syt        |t              rht        |      t        k7  sUt        |t              rDt              h dk7  s3j                  d      dk7  sj                  d      dk7  s	j                  d      t        k7  sj                  d      dk7  s݉j                  d      t        k7  st        j                  d      d	k7  sj                  d      dk7  st        fddD              sj                  d      |j                  d      k7  sbj                  d      |j                  d      k7  s?t        d |j                         D              sd   d    k(  sd   dk(  rd!   t         k7  rt        d"      S )#N>	   schema
generationhermetic_tyhermes_wheel_sha256profile_wheel_sha256trust_boundary_sha256wheelhouse_entry_countqualification_tool_sha256wheelhouse_inventory_sha256z,candidate derivation input schema is invalidrR   rM   )rN   rO   rS   rP   rK   z0task26-preexecution-product-derivation-inputs-v1rL      c           	   3  ~   K   | ]4  }t         j                  t        j                  |d                   du  6 yw N_HEX	fullmatchstrget).0fieldinputss     r*   	<genexpr>z_inputs.<locals>.<genexpr>   s0     ]}et~~c&**UB"789TA}   :=rQ   r   >
   rK   
ty_versionbinary_memberty_command_argvrunner_tool_sha256builder_tool_sha256binary_member_sha256target_python_versioncorrected_ty_wheel_sha256qualification_interpreter_rolez*task26-preexecution-hermetic-ty-binding-v2rb   z0.0.21rh   rj   selected_qualification_pythonrd   r	   rc   zty-0.0.21.data/scripts/tyc           	   3  ~   K   | ]4  }t         j                  t        j                  |d                   du  6 ywrV   rX   )r]   r^   hermetic_valuess     r*   r`   z_inputs.<locals>.<genexpr>   s=      
 NN3225"=>?4Gra   )ri   rg   rf   re   rf   r   re   r   c              3  \   K   | ]$  }t         j                  t        |            d u  & y wr>   )rY   rZ   r[   )r]   items     r*   r`   z_inputs.<locals>.<genexpr>   s'      
:N$DNN3t9%-:Ns   *,rN   rO   rS   z'candidate derivation inputs are invalid)
isinstancer?   set
ValueErrorr   r[   objectr\   anytypeint
_TOOL_KEYS _TASK26_TY_TARGET_PYTHON_VERSION_TASK26_TY_COMMAND_ARGVcountvalues!EMPTY_WHEELHOUSE_INVENTORY_SHA256)r)   toolstool_valuesrM   digest_fieldsrm   r_   s        @@r*   _inputsr   l   s   eT"c%j 
5 
' GHH$sF{#U+FJJ23E4>ud4K$tCK(%0QSK**]+K0:;0MT#v+,SU M 	

8=	>::l#q(]}]]

345S@V456:%&{z)+t,

 x(78|,867+,?@*+015LL"(();<A/&' 

 
 45??-./34??/01 
:E:L:L:N
 
 '(F3I,JJ+,14501 BCCMr,   c                p    t        |       }t        j                  t        |            j	                         S r>   )r   r3   r4   r+   r8   )r)   r_   s     r*   candidate_digest_from_inputsr      s(    U^F>>)F+,6688r,   c                    t        |       }d|t        |      d}t        j                  t	        |            j                         |d<   |S )N&task26-preexecution-product-binding-v1)rK   derivation_inputscandidate_digestbinding_sha256)r   r   r3   r4   r+   r8   )r)   r_   documents      r*   build_product_bindingr      sI    U^F:#8@#H
 ")	(0C!D!N!N!PHOr,   c                   | j                         }t        j                  |j                        sOt        j                  |j                        r0|j
                  dk7  s!t        j                  |j                        dvrt        d|       y )NrT   >        z actual sealed wheel is invalid: )lstatstatS_ISLNKst_modeS_ISREGst_nlinkS_IMODErr   )r9   labelinfos      r*   _private_wheelr      sf    ::<DT\\"||DLL)==A<<%^;;E7CDD <r,   )expected_tool_hashesexpected_trust_boundary_sha256$expected_wheelhouse_inventory_sha256expected_wheelhouse_entry_countactual_hermes_wheelactual_profile_wheelactual_ty_wheelc               ,   t        | t              rt        |       h dk7  rt        d      t	        t        t
        t        f   |       }t        |j                  d            }	|j                         D 
ci c]  \  }
}|
dk7  s|
| }}
}t        |	      }|j                  d      dk7  sR|j                  d      |k7  s>|j                  d      t        j                  t        |            j                         k7  rt        d      ||	d	   t        |      k7  rt        d
      ||	d   |k7  rt        d      ||	d   |k7  s
||	d   |k7  rt        d      |ddf|ddffD ]4  \  }}}|
t        ||       t!        |      |	|   k7  s(t        d|        |t        |d       t	        t        t
        t        f   |	d         }t!        |      |d   k7  rt        d      	 t#        j$                  |      5 }|j'                  t        |d               }d d d        t        j                        j                         |d   k7  rt        d      |S c c}}
w # 1 sw Y   ExY w# t(        t"        j*                  f$ r}t        d      |d }~ww xY w)N>   rK   r   r   r   z!product binding schema is invalidr   r   rK   r   r   z4candidate does not equal canonical derivation inputsrR   z qualification tool hashes differrP   ztrust boundary digest differsrS   rQ   z%wheelhouse derivation binding differsrN   HermesrO   profilezactual sealed wheel differs: zcorrected TyrM   ri   z!actual corrected Ty wheel differsrc   z)corrected Ty executable member is invalidrg   z&corrected Ty executable member differs)rp   r?   rq   rr   r   r[   rs   r   r\   rD   r   r3   r4   r+   r8   r   r<   zipfileZipFiler0   KeyError
BadZipFile)r)   r   r   r   r   r   r   r   r   r_   keyro   unsignedrecomputed_candidater9   r^   r   hermetic_bindingarchivememberexcs                        r*   validate_product_bindingr      s    eT"c%j 5 ' <==Df%u-HX\\"567F#+>>#3#3ic4s>N7NT	#3   8?X"JJ<<*+/CC<<()>>)H-.88:; OPP'F3N,OSWT - ;<<&2*+/MM899,801/0 	(3+,0OO@AA	3X>	5yAeU 4'4 F5M1 #@!HII "7S&[ 16-3HI'+;',
 
 @AA	S1W c*:?*K&LM 2 >>&!++-1A"2
 
 EFFOkZ 21',,- 	SHIsR	Ss<   6II&I) ;II) I&"I) )JJJc                   t        |      }t        t        t        t        f   |d         }t        | t              st        d      t        t        t        t        f   |       d|d   |d   |d   |d   d}t        fd	|j                         D              rt        d
      |d   j                  d      j                  d      hv rt        d      S )Nr   zdeployment receipt is invalidz#task26-source-deployment-receipt-v2r   r   rN   rO   )rK   r    candidate_product_binding_sha256rN   rO   c              3  L   K   | ]  \  }}j                  |      |k7    y wr>   )r\   )r]   r   ro   r   s      r*   r`   z.validate_deployment_receipt.<locals>.<genexpr>9  s&     
G6Fd8<<$6Fs   !$z3deployment receipt wheel or product binding differsz4deployment wheel field cannot equal candidate digest)
r   r   r?   r[   rs   rp   rr   rt   rD   r\   )receiptproduct_bindingbindingr_   expectedr   s        @r*   validate_deployment_receiptr   *  s     '7G$sF{#W-@%ABFgt$899Df%w/H7#$67,34D,E%&;< &'= >H 
Ghnn6F
GGNOO!"*++,'  OPPOr,   )r)   rs   returnbytes)r9   r   r   r[   )r@   zMapping[str, object]r   r[   )rE   r   rF   r   r   zdict[str, str])r)   rs   r   dict[str, object])r)   rs   r   r[   )r9   r   r   r[   r   None)r)   rs   r   zMapping[str, str] | Noner   
str | Noner   r   r   z
int | Noner   Path | Noner   r   r   r   r   r   )r   rs   r   rs   r   r   )"__doc__
__future__r   r3   r&   rer   r   pathlibr   typingr   r   compilerY   rx   ry   rw   _EMPTY_WHEELHOUSE_PAYLOADr4   r'   r(   r8   r|   r+   r<   rA   rI   r   r   r   r   r   r    r,   r*   <module>r      s   O "   	     rzz#$#)  -$ 
&  
 %3GNNDJJ! fh% )+ "GMM(,MM:Tn9
E 6:157;26'+(,#'II 3I %/	I
 +5I &0I %I &I !I IX&,r,   