"""Execute snapshot-source setup and verify exact-index refusal without APT."""
from pathlib import Path
import subprocess
import tempfile
import unittest

REPO=Path(__file__).resolve().parents[2]

class SnapshotTests(unittest.TestCase):
    def test_hook_requires_exact_indexes(self):
        with tempfile.TemporaryDirectory() as tmp:
            root=Path(tmp)
            subprocess.run(['sh',str(REPO/'image-recipe/configs/build-snapshot-sources.sh'),str(root)],check=True)
            sources=(root/'etc/apt/sources.list.d/archipelago-build.sources').read_text()
            self.assertIn('Check-Valid-Until: no',sources)
            self.assertIn('Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg',sources)
            checker=root/'usr/local/lib/archipelago/check-build-indexes.sh'
            # Test the actual algorithm with fixture digests, never change its
            # production pins or fetch mutable metadata in the unit suite.
            import hashlib,re
            lists=root/'lists'; lists.mkdir()
            for suite,contents in [('trixie',b'authenticated main fixture'),('trixie-security',b'authenticated security fixture')]:
                (lists/('fixture_dists_'+suite+'_InRelease')).write_bytes(contents)
            script=checker.read_text().replace('/var/lib/apt/lists/',str(lists)+'/')
            for suite,contents in [('trixie',b'authenticated main fixture'),('trixie-security',b'authenticated security fixture')]:
                script=re.sub(r'check [0-9a-f]{64} (.*_dists_'+suite+r'_InRelease)',lambda m:'check '+hashlib.sha256(contents).hexdigest()+' '+m[1],script)
            checker.write_text(script)
            self.assertEqual(subprocess.run(['sh',str(checker)],capture_output=True).returncode,0)
            (lists/'fixture_dists_trixie_InRelease').write_bytes(b'changed signed metadata')
            self.assertNotEqual(subprocess.run(['sh',str(checker)],capture_output=True).returncode,0)
            (lists/'fixture_dists_trixie_InRelease').unlink()
            self.assertNotEqual(subprocess.run(['sh',str(checker)],capture_output=True).returncode,0)

if __name__=='__main__': unittest.main()