codex/third_party/voice/sdk.py

"""Export development inputs from the same inspected build as the private runtime.

SDKs are build inputs, never installed user payloads. Their receipt records byte
identity and provenance, not authenticity or approval. Native loader relocation
and final helper linking remain the runtime preparer and consumer's jobs.
"""

import json
from pathlib import Path
import re
import shutil

from runtime import digest

MODULES = (
    "glib-2.0",
    "gobject-2.0",
    "gio-2.0",
    "gmodule-no-export-2.0",
    "gstreamer-1.0",
    "gstreamer-base-1.0",
    "gstreamer-app-1.0",
    "gstreamer-audio-1.0",
    "gstreamer-tag-1.0",
)


def export_sdk(prefix: Path, receipts: Path, target: str, output: Path):
    prefix, receipts = prefix.resolve(strict=True), receipts.resolve(strict=True)
    output = output.absolute()
    if (
        output.exists()
        or output.is_symlink()
        or any(output.resolve().is_relative_to(root) for root in (prefix, receipts))
    ):
        raise ValueError("SDK output must be fresh and outside the inputs")
    if not re.fullmatch(
        r"(?:aarch64|x86_64)-(?:apple-darwin|unknown-linux-gnu|pc-windows-msvc)",
        target,
    ):
        raise ValueError("unsupported SDK target")
    ci = json.loads((receipts / "ci.json").read_text())
    source_hash = digest(Path(__file__).with_name("sources.json"))
    if (
        ci.get("target") != target
        or ci.get("build_complete") is not True
        or ci.get("inspection_complete") is not True
        or ci.get("manifest_sha256") != source_hash
        or not re.fullmatch(r"[0-9a-f]{40}", ci.get("commit", ""))
    ):
        raise ValueError("SDK build receipt does not match the sources and target")
    inventory = json.loads((receipts / "inspection/binaries.json").read_text())
    if not 1 <= len(inventory) <= 128:
        raise ValueError("unexpected native inventory size")
    binaries = {}
    for record in inventory:
        name = record["path"].replace("\\", "/")
        if not re.fullmatch(r"(?:lib(?:/gstreamer-1\.0)?|bin)/[A-Za-z0-9_+.-]+", name):
            raise ValueError("invalid native inventory path")
        path = prefix / name
        if (
            name in binaries
            or path.is_symlink()
            or not path.resolve(strict=True).is_relative_to(prefix)
            or record["target"] != target
            or digest(path) != record["sha256"]
        ):
            raise ValueError("native SDK library does not match its receipt")
        binaries[name] = record["sha256"]
    selected = []
    names = set()
    size = 0
    for path in sorted(prefix.rglob("*")):
        name = path.relative_to(prefix).as_posix()
        if path.is_dir():
            if path.is_symlink():
                raise ValueError("SDK input directories must not be links")
            continue
        if not (
            name.startswith("include/")
            or name == "lib/glib-2.0/include/glibconfig.h"
            or name
            in {
                f"lib/pkgconfig/{module}.pc"
                for module in (*MODULES, "libffi", "libpcre2-8", "zlib")
            }
            or re.fullmatch(
                r"lib/[A-Za-z0-9_+.-]+\.(?:a|lib|dylib|so(?:\.[0-9]+)*)", name
            )
        ):
            continue
        source = path.resolve(strict=True)
        if not source.is_relative_to(prefix) or not source.is_file():
            raise ValueError("SDK inputs must be files inside the prefix")
        if name.casefold() in names:
            raise ValueError("SDK paths collide across platforms")
        names.add(name.casefold())
        size += source.stat().st_size
        if len(selected) >= 4096 or size > 512 * 1024 * 1024:
            raise ValueError("SDK inputs exceed the size limit")
        source_name = source.relative_to(prefix).as_posix()
        expected = digest(source)
        if re.search(r"\.(?:dylib|so(?:\.[0-9]+)*)$", name):
            if binaries.get(source_name) != expected:
                raise ValueError("SDK shared library is missing from the receipt")
        selected.append((name, source, expected))
    for module in MODULES:
        path = prefix / f"lib/pkgconfig/{module}.pc"
        if path.relative_to(prefix).as_posix().casefold() not in names or not re.search(
            r"^prefix=\$\{pcfiledir\}/\.\./\.\.$", path.read_text(), re.MULTILINE
        ):
            raise ValueError("rebuild the SDK with relocatable Meson pkg-config files")
    if "lib/glib-2.0/include/glibconfig.h" not in names:
        raise ValueError("SDK is missing the target's GLib configuration header")
    output.mkdir()
    try:
        files = []
        for name, source, expected in selected:
            destination = output / name
            destination.parent.mkdir(parents=True, exist_ok=True)
            shutil.copy2(source, destination)
            if digest(destination) != expected:
                raise ValueError("SDK input changed while copying")
            files.append({"path": name, "sha256": expected})
        (output / "sdk.json").write_text(
            json.dumps(
                {
                    "schemaVersion": 1,
                    "target": target,
                    "sourceCommit": ci["commit"],
                    "sourceManifestSha256": source_hash,
                    "files": files,
                },
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )
    except BaseException:
        shutil.rmtree(output)
        raise