"""Copy only the trusted local tmux ELF and its loader/libs into a test archive.

No host bind mount, package install or service action. The fixture image lacks
tmux; this explicit hashed artifact is qualification input, not ISO acceptance.
"""
import hashlib
import json
import os
from pathlib import Path
import stat
import subprocess
import sys
import tarfile

directory = Path(sys.argv[1])
assert directory.is_absolute() and directory.is_dir()
binary = Path('/usr/bin/tmux')
listing = subprocess.check_output(['ldd', str(binary)], text=True)
files = {binary, *(Path(word) for word in listing.split() if word.startswith('/'))}
manifest = {}
with tarfile.open(directory / 'tmux-runtime.tar', 'x') as archive:
    for path in sorted(files):
        source = path.resolve(strict=True)
        for part in [source, *source.parents]:
            meta = part.stat()
            assert meta.st_uid == 0 and not meta.st_mode & 0o022
        assert source.is_file() and path.name not in manifest
        raw = source.read_bytes()
        manifest[path.name] = {'source':str(source), 'sha256':hashlib.sha256(raw).hexdigest()}
        info = tarfile.TarInfo('tmux-runtime/' + path.name)
        info.size, info.mode, info.uid, info.gid = len(raw), 0o755, 0, 0
        import io
        archive.addfile(info, io.BytesIO(raw))
assert 'ld-linux-x86-64.so.2' in manifest, 'fixture currently qualifies x86_64 only'
(directory / 'tmux-runtime-sha256.json').write_text(json.dumps(manifest, indent=2)+'\n')