
    j/              	         d Z ddlmZ ddlZddlZddlZddlZddlZddlm	Z	 ddl
mZmZ  ej                  d      ZdZdd	d
dddegZh dZdg g dZ ej&                   ej(                  edddd      j+                               j-                         ZddZd dZd!dZ	 	 	 	 	 	 d"dZd#dZd$dZd#dZd%dZdddddddd	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 d&dZ 	 	 	 	 	 	 d'dZ!y)(zICanonical pre-execution product derivation for Task26 candidate identity.    )annotationsN)Path)Mappingcastz^[0-9a-f]{64}$z3.12z	sealed-tycheckz'gateway/platforms/nutrition_coaching.pyz--output-formatgitlab--python-version>   final_statecommit_observerty_surface_gatefrozen_bootstraptelegram_adapterty_wheel_builderevidence_contractlocal_telegram_qaruntime_authoritysource_golden_pathty_hermetic_runnercandidate_authoritycandidate_derivationdualcoach_controllerinstalled_provenancedelivered_bundle_sealerverify_source_golden_pathindependent_candidate_verifier)	root_modedirectoriesentriesFT,:ensure_ascii	sort_keys
separators	allow_nanc                R    t        j                  | dddd      j                         S )NFTr   r"   )jsondumpsencode)values    /home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-combined-prefreeze-st_01a0198f-v38/gateway/platforms/task26_candidate_derivation.py	canonicalr-   ;   s+    :: fh    c                   t        j                         }| j                  d      5 t        fdd      D ]  }|j	                  |        	 d d d        |j                         S # 1 sw Y   |j                         S xY w)Nrbc                 &     j                  d      S )Ni   )read)streams   r,   <lambda>zsha256_file.<locals>.<lambda>H   s    &++k":r.   r.   )hashlibsha256openiterupdate	hexdigest)pathdigestchunkr3   s      @r,   sha256_filer>   E   sh    ^^F	4F:C@EMM%  A 
  
 s   &A&&A>c                l    t        j                  t        t        |                   j	                         S N)r5   r6   r-   dictr:   )trust_boundarys    r,   trust_boundary_digestrC   M   s$    >>)D$89:DDFFr.   c                X   i d|dz  d|dz  d|dz  d| dz  d	|d
z  d|dz  d|dz  d|dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| d z  d!|d"z  d#| d$z  i}t        |j                               D ci c]  \  }}|t        |       c}}S c c}}w )%Nr   z/gateway/platforms/task26_candidate_authority.pyr   z0gateway/platforms/task26_candidate_derivation.pyr   zgateway/commit_observer.pyr   ztask26_seal_delivered_bundle.pyr   z4gateway/platforms/dualcoach_tasks21_25_controller.pyr   z-gateway/platforms/task26_evidence_contract.pyr
   z'gateway/platforms/task26_final_state.pyr   z-gateway/platforms/task26_runtime_authority.pyr   zindependent_verify_candidate.pyr   zinstalled_wheel_provenance.pyr   ztask26_local_telegram_qa.pyr   ztask26_frozen_bootstrap.pyr   zsource_golden_path.pyr   ztask26_hermetic_ty_runner.pyr   z#task26_build_ty_executable_wheel.pyr   ztask26_ty_surface_gate.pyr   zgateway/platforms/telegram.pyr   zverify_source_golden_path.py)sorteditemsr>   )scripts_dirpackage_rootpathsnamer;   s        r,   qualification_tool_hashesrK   Q   s   |
; < 	
<!=
 	<*FF 	";
+$, 	
@!A 	\
9: 	|&OO 	\
9: 	)+
++," 	.M M#$ 	[+HH%& 	K*FF'( 	k,CC)* 	k,JJ+, 	K*OO-. 	;)DD/0 	L+JJ12 	$[3Q%Q3E6 7=U[[]6KL6K
dD+d##6KLLLs   B&c                   t        | t              rt        |       h dk7  rt        d      t	        t        t
        t        f   |       j                  d      }t        |t              rt	        t        t
        t        f   |      ni }j                  d      }t        |t              rt	        t        t
        t        f   |      ni d}j                  d      dk7  sۉj                  d      d	k7  st        fd
|D              st        j                  d            t        ust	        t        d         dk  syt        |t              rht        |      t        k7  sUt        |t              rDt              h dk7  s3j                  d      dk7  sj                  d      dk7  s	j                  d      t        k7  sj                  d      dk7  s݉j                  d      t        k7  st        j                  d      d	k7  sj                  d      dk7  st        fddD              sj                  d      |j                  d      k7  sbj                  d      |j                  d      k7  s?t        d |j                         D              sd   d    k(  sd   dk(  rd!   t         k7  rt        d"      S )#N>	   schema
generationhermetic_tyhermes_wheel_sha256profile_wheel_sha256trust_boundary_sha256wheelhouse_entry_countqualification_tool_sha256wheelhouse_inventory_sha256z,candidate derivation input schema is invalidrT   rO   )rP   rQ   rU   rR   rM   z0task26-preexecution-product-derivation-inputs-v1rN      c           	   3  ~   K   | ]4  }t         j                  t        j                  |d                   du  6 yw N_HEX	fullmatchstrget).0fieldinputss     r,   	<genexpr>z_inputs.<locals>.<genexpr>   s0     ]}et~~c&**UB"789TA}   :=rS   r   >
   rM   
ty_versionbinary_memberty_command_argvrunner_tool_sha256builder_tool_sha256binary_member_sha256target_python_versioncorrected_ty_wheel_sha256qualification_interpreter_rolez*task26-preexecution-hermetic-ty-binding-v2rd   z0.0.21rj   rl   selected_qualification_pythonrf   r	   re   zty-0.0.21.data/scripts/tyc           	   3  ~   K   | ]4  }t         j                  t        j                  |d                   du  6 ywrX   rZ   )r_   r`   hermetic_valuess     r,   rb   z_inputs.<locals>.<genexpr>   s=      
 NN3225"=>?4Grc   )rk   ri   rh   rg   rh   r   rg   r   c              3  \   K   | ]$  }t         j                  t        |            d u  & y wr@   )r[   r\   r]   )r_   items     r,   rb   z_inputs.<locals>.<genexpr>   s'      
:N$DNN3t9%-:Ns   *,rP   rQ   rU   z'candidate derivation inputs are invalid)
isinstancerA   set
ValueErrorr   r]   objectr^   anytypeint
_TOOL_KEYS _TASK26_TY_TARGET_PYTHON_VERSION_TASK26_TY_COMMAND_ARGVcountvalues!EMPTY_WHEELHOUSE_INVENTORY_SHA256)r+   toolstool_valuesrO   digest_fieldsro   ra   s        @@r,   _inputsr   r   s   eT"c%j 
5 
' GHH$sF{#U+FJJ23E4>ud4K$tCK(%0QSK**]+K0:;0MT#v+,SU M 	

8=	>::l#q(]}]]

345S@V456:%&{z)+t,

 x(78|,867+,?@*+015LL"(();<A/&' 

 
 45??-./34??/01 
:E:L:L:N
 
 '(F3I,JJ+,14501 BCCMr.   c                p    t        |       }t        j                  t        |            j	                         S r@   )r   r5   r6   r-   r:   )r+   ra   s     r,   candidate_digest_from_inputsr      s(    U^F>>)F+,6688r.   c                    t        |       }d|t        |      d}t        j                  t	        |            j                         |d<   |S )N&task26-preexecution-product-binding-v1)rM   derivation_inputscandidate_digestbinding_sha256)r   r   r5   r6   r-   r:   )r+   ra   documents      r,   build_product_bindingr      sI    U^F:#8@#H
 ")	(0C!D!N!N!PHOr.   c                   | j                         }t        j                  |j                        sOt        j                  |j                        r0|j
                  dk7  s!t        j                  |j                        dvrt        d|       y )NrV   >        z actual sealed wheel is invalid: )lstatstatS_ISLNKst_modeS_ISREGst_nlinkS_IMODErt   )r;   labelinfos      r,   _private_wheelr      sf    ::<DT\\"||DLL)==A<<%^;;E7CDD <r.   )expected_tool_hashesexpected_trust_boundary_sha256$expected_wheelhouse_inventory_sha256expected_wheelhouse_entry_countactual_hermes_wheelactual_profile_wheelactual_ty_wheelc               ,   t        | t              rt        |       h dk7  rt        d      t	        t        t
        t        f   |       }t        |j                  d            }	|j                         D 
ci c]  \  }
}|
dk7  s|
| }}
}t        |	      }|j                  d      dk7  sR|j                  d      |k7  s>|j                  d      t        j                  t        |            j                         k7  rt        d      ||	d	   t        |      k7  rt        d
      ||	d   |k7  rt        d      ||	d   |k7  s
||	d   |k7  rt        d      |ddf|ddffD ]4  \  }}}|
t        ||       t!        |      |	|   k7  s(t        d|        |t        |d       t	        t        t
        t        f   |	d         }t!        |      |d   k7  rt        d      	 t#        j$                  |      5 }|j'                  t        |d               }d d d        t        j                        j                         |d   k7  rt        d      |S c c}}
w # 1 sw Y   ExY w# t(        t"        j*                  f$ r}t        d      |d }~ww xY w)N>   rM   r   r   r   z!product binding schema is invalidr   r   rM   r   r   z4candidate does not equal canonical derivation inputsrT   z qualification tool hashes differrR   ztrust boundary digest differsrU   rS   z%wheelhouse derivation binding differsrP   HermesrQ   profilezactual sealed wheel differs: zcorrected TyrO   rk   z!actual corrected Ty wheel differsre   z)corrected Ty executable member is invalidri   z&corrected Ty executable member differs)rr   rA   rs   rt   r   r]   ru   r   r^   rF   r   r5   r6   r-   r:   r   r>   zipfileZipFiler2   KeyError
BadZipFile)r+   r   r   r   r   r   r   r   r   ra   keyrq   unsignedrecomputed_candidater;   r`   r   hermetic_bindingarchivememberexcs                        r,   validate_product_bindingr      s    eT"c%j 5 ' <==Df%u-HX\\"567F#+>>#3#3ic4s>N7NT	#3   8?X"JJ<<*+/CC<<()>>)H-.88:; OPP'F3N,OSWT - ;<<&2*+/MM899,801/0 	(3+,0OO@AA	3X>	5yAeU 4'4 F5M1 #@!HII "7S&[ 16-3HI'+;',
 
 @AA	S1W c*:?*K&LM 2 >>&!++-1A"2
 
 EFFOkZ 21',,- 	SHIsR	Ss<   6II&I) ;II) I&"I) )JJJc                   t        |      }t        t        t        t        f   |d         }t        | t              st        d      t        t        t        t        f   |       d|d   |d   |d   |d   d}t        fd	|j                         D              rt        d
      |d   j                  d      j                  d      hv rt        d      S )Nr   zdeployment receipt is invalidz#task26-source-deployment-receipt-v2r   r   rP   rQ   )rM   r    candidate_product_binding_sha256rP   rQ   c              3  L   K   | ]  \  }}j                  |      |k7    y wr@   )r^   )r_   r   rq   r   s      r,   rb   z.validate_deployment_receipt.<locals>.<genexpr>?  s&     
G6Fd8<<$6Fs   !$z3deployment receipt wheel or product binding differsz4deployment wheel field cannot equal candidate digest)
r   r   rA   r]   ru   rr   rt   rv   rF   r^   )receiptproduct_bindingbindingra   expectedr   s        @r,   validate_deployment_receiptr   0  s     '7G$sF{#W-@%ABFgt$899Df%w/H7#$67,34D,E%&;< &'= >H 
Ghnn6F
GGNOO!"*++,'  OPPOr.   )r+   ru   returnbytes)r;   r   r   r]   )rB   zMapping[str, object]r   r]   )rG   r   rH   r   r   zdict[str, str])r+   ru   r   dict[str, object])r+   ru   r   r]   )r;   r   r   r]   r   None)r+   ru   r   zMapping[str, str] | Noner   
str | Noner   r   r   z
int | Noner   Path | Noner   r   r   r   r   r   )r   ru   r   ru   r   r   )"__doc__
__future__r   r5   r(   rer   r   pathlibr   typingr   r   compiler[   rz   r{   ry   _EMPTY_WHEELHOUSE_PAYLOADr6   r)   r*   r:   r~   r-   r>   rC   rK   r   r   r   r   r   r    r.   r,   <module>r      s   O "   	     rzz#$#)  -$ 
*  
 %3GNNDJJ! fh% )+ "GMM(,MMBTn9
E 6:157;26'+(,#'II 3I %/	I
 +5I &0I %I &I !I IX&,r.   