#!/usr/bin/env python3
"""Validate private ARM execution and prove the host binfmt registry is unchanged."""
from pathlib import Path
import subprocess

project = Path(__file__).resolve().parents[2]
registry = Path('/proc/sys/fs/binfmt_misc')
def snapshot():
    return {path.name: path.read_bytes() for path in registry.iterdir() if path.name != 'register'}
before = snapshot()
command = [str(project/'tools/in-rootfs'), str(project/'out/rootfs-aarch64'), '/bin/bash', '-euc']
result = subprocess.run([*command, 'test -f /tmp/fds-binfmt/fds-aarch64; grep -qx ID=fds /usr/lib/os-release; printf "nested ARM execution\\n" | gzip | gzip -d; grep CapEff /proc/self/status'], check=True, capture_output=True, text=True)
assert 'nested ARM execution\n' in result.stdout
assert '0000000080000000' in result.stdout, 'Setup capabilities were not dropped'
failure = subprocess.run([*command, 'exit 73'])
assert failure.returncode == 73, 'Target failure exit code was not preserved'
assert snapshot() == before, 'Host binfmt registry changed'
print('PASS: private ARM child execution, restricted build capabilities, exit status and unchanged host registry')