
    ej-,              	         d Z ddlmZ ddlZddlZddlZddlZddlZddlm	Z	 ddl
mZmZ  ej                  d      Zh dZdg g dZ ej"                   ej$                  ed	d
dd	      j'                               j)                         ZddZddZddZ	 	 	 	 	 	 ddZddZddZddZddZdddddddd	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 ddZ	 	 	 	 	 	 d dZy)!zICanonical pre-execution product derivation for Task26 candidate identity.    )annotationsN)Path)Mappingcastz^[0-9a-f]{64}$>   final_statecommit_observerty_surface_gatefrozen_bootstraptelegram_adapterty_wheel_builderevidence_contractlocal_telegram_qaruntime_authoritysource_golden_pathty_hermetic_runnercandidate_derivationdualcoach_controllerinstalled_provenanceverify_source_golden_pathindependent_candidate_verifier)	root_modedirectoriesentriesFT,:ensure_ascii	sort_keys
separators	allow_nanc                R    t        j                  | dddd      j                         S )NFTr   r   )jsondumpsencode)values    /home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-final-state-v7-prefreeze-st_01a01574-v30/gateway/platforms/task26_candidate_derivation.py	canonicalr(   /   s+    :: fh    c                   t        j                         }| j                  d      5 t        fdd      D ]  }|j	                  |        	 d d d        |j                         S # 1 sw Y   |j                         S xY w)Nrbc                 &     j                  d      S )Ni   )read)streams   r'   <lambda>zsha256_file.<locals>.<lambda><   s    &++k":r)   r)   )hashlibsha256openiterupdate	hexdigest)pathdigestchunkr.   s      @r'   sha256_filer9   9   sh    ^^F	4F:C@EMM%  A 
  
 s   &A&&A>c                l    t        j                  t        t        |                   j	                         S N)r0   r1   r(   dictr5   )trust_boundarys    r'   trust_boundary_digestr>   A   s$    >>)D$89:DDFFr)   c                >   i d|dz  d|dz  d|dz  d|dz  d	|d
z  d|dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d| dz  d|dz  d| d z  }t        |j                               D ci c]  \  }}|t        |       c}}S c c}}w )!Nr   z0gateway/platforms/task26_candidate_derivation.pyr   zgateway/commit_observer.pyr   z4gateway/platforms/dualcoach_tasks21_25_controller.pyr   z-gateway/platforms/task26_evidence_contract.pyr   z'gateway/platforms/task26_final_state.pyr   z-gateway/platforms/task26_runtime_authority.pyr   zindependent_verify_candidate.pyr   zinstalled_wheel_provenance.pyr   ztask26_local_telegram_qa.pyr
   ztask26_frozen_bootstrap.pyr   zsource_golden_path.pyr   ztask26_hermetic_ty_runner.pyr   z#task26_build_ty_executable_wheel.pyr	   ztask26_ty_surface_gate.pyr   zgateway/platforms/telegram.pyr   zverify_source_golden_path.py)sorteditemsr9   )scripts_dirpackage_rootpathsnamer6   s        r'   qualification_tool_hashesrF   E   sg   
<!= 	<*FF 	
@!A	 	\
9: 	|&OO 	\
9: 	)+
++, 	.M M 	[+HH 	K*FF  	k,CC!" 	k,JJ#$ 	K*OO%& 	;)DD'( 	L+JJ)* 	$[3Q%Q+E. 7=U[[]6KL6K
dD+d##6KLLLs   ?Bc                   t        | t              rt        |       h dk7  rt        d      t	        t        t
        t        f   |       j                  d      }t        |t              rt	        t        t
        t        f   |      ni }j                  d      }t        |t              rt	        t        t
        t        f   |      ni d}j                  d      dk7  szj                  d      d	k7  set        fd
|D              sPt        j                  d            t        us/t	        t        d         dk  st        |t              rt        |      t        k7  st        |t              rt              h dk7  sՉj                  d      dk7  sj                  d      dk7  sj                  d      dk7  st        fddD              sj                  d      |j                  d      k7  sbj                  d      |j                  d      k7  s?t        d |j                         D              sd   d   k(  sd   dk(  rd   t        k7  rt        d      S )N>	   schema
generationhermetic_tyhermes_wheel_sha256profile_wheel_sha256trust_boundary_sha256wheelhouse_entry_countqualification_tool_sha256wheelhouse_inventory_sha256z,candidate derivation input schema is invalidrO   rJ   )rK   rL   rP   rM   rH   z0task26-preexecution-product-derivation-inputs-v1rI      c           	   3  ~   K   | ]4  }t         j                  t        j                  |d                   du  6 yw N_HEX	fullmatchstrget).0fieldinputss     r'   	<genexpr>z_inputs.<locals>.<genexpr>   s0     ]}et~~c&**UB"789TA}   :=rN   r   >   rH   
ty_versionbinary_memberrunner_tool_sha256builder_tool_sha256binary_member_sha256corrected_ty_wheel_sha256z*task26-preexecution-hermetic-ty-binding-v1r_   z0.0.21r`   zty-0.0.21.data/scripts/tyc           	   3  ~   K   | ]4  }t         j                  t        j                  |d                   du  6 ywrS   rU   )rZ   r[   hermetic_valuess     r'   r]   z_inputs.<locals>.<genexpr>   s=      
 NN3225"=>?4Gr^   )rd   rc   rb   ra   rb   r   ra   r   c              3  \   K   | ]$  }t         j                  t        |            d u  & y wr;   )rV   rW   rX   )rZ   items     r'   r]   z_inputs.<locals>.<genexpr>   s'      
:N$DNN3t9%-:Ns   *,rK   rL   rP   z'candidate derivation inputs are invalid)
isinstancer<   set
ValueErrorr   rX   objectrY   anytypeint
_TOOL_KEYSvalues!EMPTY_WHEELHOUSE_INVENTORY_SHA256)r&   toolstool_valuesrJ   digest_fieldsrf   r\   s        @@r'   _inputsrv   b   s?   eT"c%j 
5 
' GHH$sF{#U+FJJ23E4>ud4K$tCK(%0QSK**]+K0:;0MT#v+,SU M 	

8=	>::l#q(]}]]

345S@V456:%&{z)+t,
	
 x(78|,8/&' 

 
 45??-./34??/01 
:E:L:L:N
 
 '(F3I,JJ+,14501 BCCMr)   c                p    t        |       }t        j                  t        |            j	                         S r;   )rv   r0   r1   r(   r5   )r&   r\   s     r'   candidate_digest_from_inputsrx      s(    U^F>>)F+,6688r)   c                    t        |       }d|t        |      d}t        j                  t	        |            j                         |d<   |S )N&task26-preexecution-product-binding-v1)rH   derivation_inputscandidate_digestbinding_sha256)rv   rx   r0   r1   r(   r5   )r&   r\   documents      r'   build_product_bindingr      sI    U^F:#8@#H
 ")	(0C!D!N!N!PHOr)   c                   | j                         }t        j                  |j                        sOt        j                  |j                        r0|j
                  dk7  s!t        j                  |j                        dvrt        d|       y )NrQ   >        z actual sealed wheel is invalid: )lstatstatS_ISLNKst_modeS_ISREGst_nlinkS_IMODErk   )r6   labelinfos      r'   _private_wheelr      sf    ::<DT\\"||DLL)==A<<%^;;E7CDD <r)   )expected_tool_hashesexpected_trust_boundary_sha256$expected_wheelhouse_inventory_sha256expected_wheelhouse_entry_countactual_hermes_wheelactual_profile_wheelactual_ty_wheelc               ,   t        | t              rt        |       h dk7  rt        d      t	        t        t
        t        f   |       }t        |j                  d            }	|j                         D 
ci c]  \  }
}|
dk7  s|
| }}
}t        |	      }|j                  d      dk7  sR|j                  d      |k7  s>|j                  d      t        j                  t        |            j                         k7  rt        d      ||	d	   t        |      k7  rt        d
      ||	d   |k7  rt        d      ||	d   |k7  s
||	d   |k7  rt        d      |ddf|ddffD ]4  \  }}}|
t        ||       t!        |      |	|   k7  s(t        d|        |t        |d       t	        t        t
        t        f   |	d         }t!        |      |d   k7  rt        d      	 t#        j$                  |      5 }|j'                  t        |d               }d d d        t        j                        j                         |d   k7  rt        d      |S c c}}
w # 1 sw Y   ExY w# t(        t"        j*                  f$ r}t        d      |d }~ww xY w)N>   rH   r}   r|   r{   z!product binding schema is invalidr{   r}   rH   rz   r|   z4candidate does not equal canonical derivation inputsrO   z qualification tool hashes differrM   ztrust boundary digest differsrP   rN   z%wheelhouse derivation binding differsrK   HermesrL   profilezactual sealed wheel differs: zcorrected TyrJ   rd   z!actual corrected Ty wheel differsr`   z)corrected Ty executable member is invalidrc   z&corrected Ty executable member differs)ri   r<   rj   rk   r   rX   rl   rv   rY   rA   rx   r0   r1   r(   r5   r   r9   zipfileZipFiler-   KeyError
BadZipFile)r&   r   r   r   r   r   r   r   r~   r\   keyrh   unsignedrecomputed_candidater6   r[   r   hermetic_bindingarchivememberexcs                        r'   validate_product_bindingr      s    eT"c%j 5 ' <==Df%u-HX\\"567F#+>>#3#3ic4s>N7NT	#3   8?X"JJ<<*+/CC<<()>>)H-.88:; OPP'F3N,OSWT - ;<<&2*+/MM899,801/0 	(3+,0OO@AA	3X>	5yAeU 4'4 F5M1 #@!HII "7S&[ 16-3HI'+;',
 
 @AA	S1W c*:?*K&LM 2 >>&!++-1A"2
 
 EFFOkZ 21',,- 	SHIsR	Ss<   6II&I) ;II) I&"I) )JJJc                   t        |      }t        t        t        t        f   |d         }t        | t              st        d      t        t        t        t        f   |       d|d   |d   |d   |d   d}t        fd	|j                         D              rt        d
      |d   j                  d      j                  d      hv rt        d      S )Nr{   zdeployment receipt is invalidz#task26-source-deployment-receipt-v2r|   r}   rK   rL   )rH   r|    candidate_product_binding_sha256rK   rL   c              3  L   K   | ]  \  }}j                  |      |k7    y wr;   )rY   )rZ   r   rh   r~   s      r'   r]   z.validate_deployment_receipt.<locals>.<genexpr>&  s&     
G6Fd8<<$6Fs   !$z3deployment receipt wheel or product binding differsz4deployment wheel field cannot equal candidate digest)
r   r   r<   rX   rl   ri   rk   rm   rA   rY   )receiptproduct_bindingbindingr\   expectedr~   s        @r'   validate_deployment_receiptr     s     '7G$sF{#W-@%ABFgt$899Df%w/H7#$67,34D,E%&;< &'= >H 
Ghnn6F
GGNOO!"*++,'  OPPOr)   )r&   rl   returnbytes)r6   r   r   rX   )r=   zMapping[str, object]r   rX   )rB   r   rC   r   r   zdict[str, str])r&   rl   r   dict[str, object])r&   rl   r   rX   )r6   r   r   rX   r   None)r&   rl   r   zMapping[str, str] | Noner   
str | Noner   r   r   z
int | Noner   Path | Noner   r   r   r   r   r   )r   rl   r   rl   r   r   ) __doc__
__future__r   r0   r#   rer   r   pathlibr   typingr   r   compilerV   rp   _EMPTY_WHEELHOUSE_PAYLOADr1   r$   r%   r5   rr   r(   r9   r>   rF   rv   rx   r   r   r   r    r)   r'   <module>r      ss   O "   	     rzz#$
&  
 %3GNNDJJ! fh% )+ "GMM(,MM:K\9
E 6:157;26'+(,#'II 3I %/	I
 +5I &0I %I &I !I IX&,r)   