build: add checked Windows desktop archive packaging

tools/test_package_windows.py

@@ -0,0 +1,59 @@
+import hashlib
+import json
+from pathlib import Path
+import struct
+import tempfile
+import unittest
+import zipfile
+
+from package_windows import package
+
+
+def executable(path, machine=0x8664):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    data = bytearray(70)
+    data[:2] = b"MZ"
+    struct.pack_into("<I", data, 60, 64)
+    data[64:68] = b"PE\0\0"
+    struct.pack_into("<H", data, 68, machine)
+    path.write_bytes(data)
+
+
+class PackageTests(unittest.TestCase):
+    def fixture(self, directory):
+        root = Path(directory)
+        resources = root / "apps/desktop/src-tauri/resources"
+        app = root / "build/app.exe"
+        executable(app)
+        (root / "LICENSE").write_text("application notice")
+        for name in ["searchi-gemma-worker.exe", "media-runtime/bin/ffmpeg.exe", "media-runtime/bin/ffprobe.exe"]:
+            executable(resources / name)
+        for name in ["LLAMA-LICENSE.txt", "licenses/font.txt", "media-runtime/licenses/LICENSE.txt", "media-runtime/manifest.json"]:
+            path = resources / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text("notice")
+        (resources / "settings.json").write_text("private settings")
+        return root, resources, app, root / "archive.zip"
+
+    def test_complete_archive_excludes_settings_and_verifies_recorded_bytes(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root, _, app, output = self.fixture(directory)
+            package(root, app, output)
+            with zipfile.ZipFile(output) as archive:
+                self.assertNotIn("settings.json", archive.namelist())
+                self.assertIn("media-runtime/bin/ffprobe.exe", archive.namelist())
+                for record in json.loads(archive.read("PACKAGE.json"))["files"]:
+                    self.assertEqual(hashlib.sha256(archive.read(record["path"])).hexdigest(), record["sha256"])
+
+    def test_mixed_architecture_preserves_previous_archive(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root, resources, app, output = self.fixture(directory)
+            output.write_bytes(b"previous package")
+            executable(resources / "searchi-gemma-worker.exe", 0xAA64)
+            with self.assertRaisesRegex(ValueError, "architecture differs"):
+                package(root, app, output)
+            self.assertEqual(output.read_bytes(), b"previous package")
+
+
+if __name__ == "__main__":
+    unittest.main()