build-release.py

#!/usr/bin/env python3
from pathlib import Path
import hashlib
import json
import subprocess
import sys
import zipfile

root = Path(__file__).resolve().parent
run = subprocess.run([sys.executable, str(root / 'verify-minimal-quotient.py')],
                     capture_output=True, text=True, check=True, cwd=root)
(root / 'verification-output.txt').write_text(run.stdout)
result = json.loads((root / 'exact-results.json').read_text())
assert result['status'] == 'passed'
archive = 'minimal-trace-kernel-attack.zip'
excluded = {archive, 'SHA256SUMS.txt', 'ARCHIVE-SHA256.txt', 'archive-validation.txt'}
payload = sorted(p for p in root.iterdir() if p.is_file() and p.name not in excluded)
digest = lambda data: hashlib.sha256(data).hexdigest()
(root / 'SHA256SUMS.txt').write_text(''.join(f'{digest(p.read_bytes())}  {p.name}\n' for p in payload))
with zipfile.ZipFile(root / archive, 'w') as z:
    for p in sorted(payload + [root / 'SHA256SUMS.txt']):
        info = zipfile.ZipInfo(p.name, (2026, 9, 8, 0, 0, 0))
        info.external_attr = 0o100644 << 16
        z.writestr(info, p.read_bytes(), compress_type=zipfile.ZIP_DEFLATED, compresslevel=9)
sha = digest((root / archive).read_bytes())
(root / 'ARCHIVE-SHA256.txt').write_text(f'{sha}  {archive}\n')
with zipfile.ZipFile(root / archive) as z:
    assert z.testzip() is None
    for p in payload + [root / 'SHA256SUMS.txt']:
        assert z.read(p.name) == p.read_bytes()
(root / 'archive-validation.txt').write_text(
    'PASS: exact native trace-kernel certificate, ordered-monomial check, cable framing and parity detector.\n'
    f'PASS: {len(payload)} payload files hashed and matched after extraction.\n'
    f'Archive SHA-256: {sha}\n'
    'Scope: fixed native datum; minimal meridian target nonzero; every compatible filled trace zero.\n')
print((root / 'archive-validation.txt').read_text(), end='')