Require document helper in Linux headless packages and verify Unix worker

tools/test_package_linux.py

@@ -10,6 +10,7 @@ from unittest import mock
 
 import package_linux as pack
 from embeddinggemma2 import runtime_provenance as provenance
+import stage_extraction_worker as extraction
 
 
 def elf(path, machine=62):
@@ -21,12 +22,57 @@ def elf(path, machine=62):
 
 
 class LinuxPackageTests(unittest.TestCase):
+    def test_extraction_missing_stale_tampered_or_wrong_architecture_preserves_output(self):
+        for mutation in ("missing", "inventory_missing", "stale", "tampered", "architecture"):
+            with self.subTest(mutation=mutation), tempfile.TemporaryDirectory() as directory:
+                fixture = self.fixture(directory)
+                root, _, runtime, _, output = fixture
+                output.write_bytes(b"previous archive")
+                helper = runtime / "searchi-extract-worker"
+                if mutation == "missing":
+                    helper.unlink()
+                elif mutation == "inventory_missing":
+                    (runtime / "extraction-worker.json").unlink()
+                elif mutation == "stale":
+                    source = root / "crates/searchi-extract-worker/src/main.rs"
+                    source.write_bytes(source.read_bytes() + b"\n// changed\n")
+                elif mutation == "tampered":
+                    helper.write_bytes(helper.read_bytes() + b"changed")
+                else:
+                    elf(helper, machine=183)
+                    inventory = runtime / "extraction-worker.json"
+                    manifest = json.loads(inventory.read_text())
+                    manifest["file"] = extraction.identity(helper)[2]
+                    inventory.write_text(json.dumps(manifest))
+                with self.assertRaises(ValueError):
+                    self.run_package(fixture)
+                self.assertEqual(output.read_bytes(), b"previous archive")
+                self.assertEqual(list(output.parent.glob("*.partial")), [])
+
+    def test_extraction_dependency_closure_and_search_paths_preserve_output(self):
+        for metadata in ({"NEEDED": ["libunpackaged.so.1"]},
+                         {"NEEDED": ["libvulkan.so.1"]},
+                         {"RUNPATH": ["$ORIGIN"]}, {"RPATH": ["/build/lib"]}):
+            with self.subTest(metadata=metadata), tempfile.TemporaryDirectory() as directory:
+                fixture = self.fixture(directory)
+                fixture[-1].write_bytes(b"previous archive")
+                def dependencies(path):
+                    return metadata if path.name == "searchi-extract-worker" else self.metadata(path)
+                with mock.patch.object(pack, "dynamic", side_effect=dependencies), self.assertRaisesRegex(ValueError, "Extraction helper"):
+                    pack.package(*fixture)
+                self.assertEqual(fixture[-1].read_bytes(), b"previous archive")
+                self.assertEqual(list(fixture[-1].parent.glob("*.partial")), [])
+
     def fixture(self, directory):
         root = Path(directory)
         for name in provenance.INPUTS:
             path = root / name
             path.parent.mkdir(parents=True, exist_ok=True)
             path.write_bytes((provenance.ROOT / name).read_bytes())
+        for name in extraction.fingerprint()["inputs"]:
+            path = root / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes((extraction.ROOT / name).read_bytes())
         runtime, media = root / "runtime", root / "media"
         executable = root / "build/searchi"
         elf(executable)
@@ -36,6 +82,9 @@ class LinuxPackageTests(unittest.TestCase):
         license.write_text("llama MIT notice")
         names = ["libggml.so.0", "libggml-base.so.0", "libllama.so.0", "libmtmd.so.0", "libggml-cpu-x64.so", "libggml-vulkan.so"]
         elf(runtime / "searchi-gemma-worker")
+        helper = root / "build/searchi-extract-worker"
+        elf(helper)
+        extraction.stage(helper, extraction.fingerprint(root), runtime, root)
         records = []
         for name in names:
             elf(runtime / name)
@@ -91,6 +140,8 @@ class LinuxPackageTests(unittest.TestCase):
                     self.assertEqual(member.uid, 0)
                     self.assertEqual(member.mtime, 0)
                 self.assertEqual(archive.getmember("searchi").mode, 0o755)
+                self.assertEqual(archive.getmember("searchi-extract-worker").mode, 0o755)
+                self.assertEqual(archive.getmember("extraction-worker.json").mode, 0o644)
                 self.assertEqual(archive.getmember("media-runtime/bin/ffmpeg").mode, 0o755)
                 self.assertEqual(archive.getmember("LICENSE.txt").mode, 0o644)