Private native dpkg comparison-tool admission

PROSPECTIVE NOT RUN. Host has no dpkg command. The already retained Debian12 image supplies dpkg1.21.23; the neighboring dpkg-deb and bz2 are already the pinned private utilities used for fresh artifacts. Read-only source inspection found native dpkg318096bytes, SHA f6a5bac0fd35a14257805d305ab2c406099901a16cdf22a4d546e51c5f8fb70d matching its installed package manifest MD5 84b6772e2b8c2018db947ceae8f87d3b; manifest SHA05c419bf. No download, install or package byte change.

Exact admission stages ONLY new exclusive dpkg.real/dpkg wrapper under DATA/tools/candidate-dpkg/bin, validates version and positive/negative native alpha0/alpha1 comparisons. Existing dpkg-deb/provenance/library untouched; failure retains new tool and raw report rather than deleting blindly. Every process is inside default16/20GiB/swap0/1800s/full1GiB/fresh95GB complete namespace census. Wrapper uses existing /lib64 loader and private library search path. No Cargo/guest/native package constructor; latter remains HOLD until separateinput re-pin review.

Driver f6c753b5 pins clean reviewed902b1ec. Script SHA256 d93c422a5e183c5d55a8cd275eb4ae350840446e4688475c677a2290d354c6f3.

python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/run-step-owner-fixture-final-docs-02.py private-dpkg-comparison-tool-controls-01 1073741824 python3 -B /run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01/stage-private-dpkg-comparison-tool.py

Exact helper:

"""Stage only the already retained native version-comparison utility."""
import hashlib
import json
import os
from pathlib import Path
import stat
import subprocess
import sys

DATA = Path('/run/media/kmosoti/data/FabricO11y')
REPO = DATA / 'scratch/owner-walkthrough-harness'
sys.path.insert(0, str(REPO / 'tools'))
from resource_group import require_limits


def require(condition, reason):
    if not condition:
        raise ValueError(reason)


def main():
    require_limits()
    target = DATA / 'tools/candidate-dpkg/bin'
    prior = json.loads((target.parent / 'provenance.json').read_text())
    source = Path(prior['files'][0]['origin']).with_name('dpkg')
    manifest = source.parents[2] / 'var/lib/dpkg/info/dpkg.md5sums'
    require(hashlib.sha256(manifest.read_bytes()).hexdigest() ==
            '05c419bfe5dd63d394527bce04e6cc2cb6c6b32535ddb1f78dc70249f7372e14', 'package manifest changed')
    require(source.resolve(strict=True) == source and not source.is_symlink(), 'noncanonical source')
    before = source.stat()
    require(stat.S_ISREG(before.st_mode) and before.st_size == 318096, 'unexpected source utility')
    fd = os.open(source, os.O_RDONLY | os.O_NOFOLLOW)
    with os.fdopen(fd, 'rb') as stream:
        raw = stream.read(318097)
        require(os.fstat(stream.fileno()) == before and source.stat() == before, 'source changed')
    digest = hashlib.sha256(raw).hexdigest()
    require(digest == 'f6a5bac0fd35a14257805d305ab2c406099901a16cdf22a4d546e51c5f8fb70d', 'source digest changed')
    require(hashlib.md5(raw).hexdigest() == '84b6772e2b8c2018db947ceae8f87d3b', 'installed package digest differs')
    real, wrapper = target / 'dpkg.real', target / 'dpkg'
    report_path = DATA / 'results/candidate-build-fresh-8fb6f413179b-01/private-dpkg-comparison-tool-01.json'
    require(target.resolve(strict=True) == target and all(not path.exists() and not path.is_symlink()
            for path in (real, wrapper, report_path)), 'exclusive utility output required')
    with real.open('xb') as stream:
        stream.write(raw)
    real.chmod(0o700)
    text = '#!/bin/sh\nexec /lib64/ld-linux-x86-64.so.2 --library-path "/run/media/kmosoti/data/FabricO11y/tools/candidate-dpkg/lib" "/run/media/kmosoti/data/FabricO11y/tools/candidate-dpkg/bin/dpkg.real" "$@"\n'
    with wrapper.open('x') as stream:
        stream.write(text)
    wrapper.chmod(0o700)
    commands = []
    for args, expected in ((['--version'], 0),
            (['--compare-versions', '0.1.0~alpha.0', 'lt', '0.1.0~alpha.1'], 0),
            (['--compare-versions', '0.1.0~alpha.1', 'lt', '0.1.0~alpha.0'], 1)):
        command = [str(wrapper), *args]
        result = subprocess.run(command, capture_output=True, text=True, timeout=5)
        require(len(result.stdout.encode()) + len(result.stderr.encode()) <= 65536, 'utility output cap')
        commands.append(dict(command=command, exit=result.returncode, expected_exit=expected,
                             stdout=result.stdout, stderr=result.stderr))
    report = dict(role='private native comparison utility; no install or package changes',
                  source=str(source), source_sha256=digest, wrapper=str(wrapper),
                  wrapper_sha256=hashlib.sha256(wrapper.read_bytes()).hexdigest(), commands=commands)
    report['state'] = 'validated' if all(item['exit'] == item['expected_exit'] for item in commands) else 'failed'
    with report_path.open('x') as stream:
        stream.write(json.dumps(report, indent=2) + '\n')
    report_path.chmod(0o600)
    require(report['state'] == 'validated', 'native version-comparison control failed; staged tool/evidence retained')
    print(json.dumps(report, indent=2))


if __name__ == '__main__':
    main()