import copy,importlib.util,json,tempfile,unittest,shutil
from pathlib import Path
ROOT=Path(__file__).parent
spec=importlib.util.spec_from_file_location('compare',ROOT/'compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
spec=importlib.util.spec_from_file_location('inputs',ROOT/'check_build_inputs.py');inputs=importlib.util.module_from_spec(spec);spec.loader.exec_module(inputs)
CASE=ROOT.parents[1]/'docs/evidence/2026-10-11-zlib-remediation-candidate'
class NarrowCandidate(unittest.TestCase):
    def test_actual_single_package_delta(self):
        a=json.loads((CASE/'base-runtime.json').read_text());b=json.loads((CASE/'candidate-runtime.json').read_text());self.assertTrue(cmp.compare(a,b)['zlib_only_delta'])
    def test_unrelated_package_policy_identity_backend_database_python_refuse(self):
        a=json.loads((CASE/'base-runtime.json').read_text());original=json.loads((CASE/'candidate-runtime.json').read_text())
        for field in ('package','policy','uid','backend','database','python'):
            b=copy.deepcopy(original)
            if field=='package':b['apk_packages']['musl']='different'
            elif field=='policy':b['policy_sha256']='0'*64
            elif field=='uid':b['uid']=0
            elif field=='backend':b['malformed_zlib_refusals']=0
            elif field=='database':b['database_opened']=True
            else:b['python_dependencies']['PyJWT']='different'
            with self.subTest(field=field),self.assertRaises(ValueError):cmp.compare(a,b)
    def test_mutated_package_or_index_refuse(self):
        source=ROOT.parents[1]/'deploy/zlib-overlay'
        for name in ('zlib-1.3.2-r1.apk','APKINDEX.tar.gz'):
            with tempfile.TemporaryDirectory() as directory:
                root=Path(directory)/'context';shutil.copytree(source,root);p=root/name;p.write_bytes(p.read_bytes()+b'changed')
                with self.assertRaises(ValueError):inputs.verify(root)
    def test_closed_recipe(self):
        source=ROOT.parents[1]/'deploy/zlib-overlay';self.assertEqual(inputs.verify(source)['input_files'],4)
        text=(source/'Containerfile').read_text()
        for fragment in ('--no-preupgrade','--no-logfile','--no-network','--repositories-file /dev/null','--repository /tmp/infd-zlib zlib'):self.assertIn(fragment,text)
        self.assertNotIn('--allow-untrusted',text)
if __name__=='__main__':unittest.main()