Prepare independently reviewed zlib-only image candidate

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

tools/zlib_overlay/check_build_inputs.py

@@ -0,0 +1,19 @@
+"""Exact public input verification only; signature verification remains mandatory in build."""
+import hashlib,json,sys
+from pathlib import Path
+
+def verify(root):
+    pins=json.loads((root/'pins.json').read_text())
+    if set(pins['files'])!={'.dockerignore','Containerfile','zlib-1.3.2-r1.apk','APKINDEX.tar.gz'}:raise ValueError('unclosed inputs')
+    if pins['base_image']!='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a':raise ValueError('base pin changed')
+    for name,digest in pins['files'].items():
+        p=root/name
+        if p.is_symlink() or not p.is_file() or p.stat().st_size>1024*1024:raise ValueError('regular bounded source required')
+        if hashlib.sha256(p.read_bytes()).hexdigest()!=digest:raise ValueError('changed bytes')
+    digest=hashlib.sha256(json.dumps(pins['files'],sort_keys=True,separators=(',',':')).encode()).hexdigest()
+    if digest!=pins['context_sha256']:raise ValueError('context mismatch')
+    return {'context_sha256':digest,'input_files':4}
+
+if __name__=='__main__':
+    try:print(json.dumps(verify(Path(sys.argv[1]))))
+    except Exception:raise SystemExit('exact build inputs refused') from None