Guard Linux speech runtime dependency closure and relocatable lookup

tools/speech-runtime/test_build.py

@@ -28,6 +28,27 @@ class BuildContract(unittest.TestCase):
         self.assertTrue(callable(build.shared_helper("build_runtime.py").bundle_windows_crt))
         self.assertTrue(callable(build.shared_helper("provision_vulkan.py").provision))
 
+    def test_linux_closure_rejects_build_paths_and_missing_dependencies(self):
+        from types import SimpleNamespace
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            for name in ['searchi-speech-worker', 'libwhisper.so.1', 'libggml-vulkan.so']:
+                (root / name).write_bytes(b'fixture')
+            metadata = {'RUNPATH': ['$ORIGIN'], 'NEEDED': ['libwhisper.so.1', 'libc.so.6']}
+            helper = SimpleNamespace(elf_dynamic=lambda _: metadata, LINUX_SYSTEM_LIBRARIES={'libc.so.6'})
+            with patch.object(build, 'shared_helper', return_value=helper):
+                build.verify_linux_closure(root)
+                metadata['RUNPATH'] = ['/tmp/build']
+                with self.assertRaisesRegex(ValueError, 'origin-only'):
+                    build.verify_linux_closure(root)
+                metadata['RUNPATH'] = ['$ORIGIN']
+                metadata['NEEDED'] = ['libmissing.so']
+                with self.assertRaisesRegex(ValueError, 'Unpackaged'):
+                    build.verify_linux_closure(root)
+                metadata['NEEDED'] = ['libvulkan.so.1']
+                with self.assertRaisesRegex(ValueError, 'Unpackaged'):
+                    build.verify_linux_closure(root)
+
 
 if __name__ == "__main__":
     unittest.main()