"""Exact public input verification only; signature verification remains mandatory in build."""
import hashlib,json,sys
from pathlib import Path

def verify(root):
    pins=json.loads((root/'pins.json').read_text())
    if set(pins['files'])!={'.dockerignore','Containerfile','zlib-1.3.2-r1.apk','APKINDEX.tar.gz'}:raise ValueError('unclosed inputs')
    if pins['base_image']!='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a':raise ValueError('base pin changed')
    for name,digest in pins['files'].items():
        p=root/name
        if p.is_symlink() or not p.is_file() or p.stat().st_size>1024*1024:raise ValueError('regular bounded source required')
        if hashlib.sha256(p.read_bytes()).hexdigest()!=digest:raise ValueError('changed bytes')
    digest=hashlib.sha256(json.dumps(pins['files'],sort_keys=True,separators=(',',':')).encode()).hexdigest()
    if digest!=pins['context_sha256']:raise ValueError('context mismatch')
    return {'context_sha256':digest,'input_files':4}

if __name__=='__main__':
    try:print(json.dumps(verify(Path(sys.argv[1]))))
    except Exception:raise SystemExit('exact build inputs refused') from None