"""Verify and unpack the trusted, pinned pipeline bundle before running a job."""

import hashlib
import json
import tarfile
from pathlib import Path


def unpack(app, destination):
    archive = app / "pipeline-source.tar.gz"
    version = json.loads((app / "pipeline-version.json").read_text())
    if hashlib.sha256(archive.read_bytes()).hexdigest() != version["sha256"]:
        raise RuntimeError("Pipeline archive checksum mismatch")
    with tarfile.open(archive) as bundle:
        bundle.extractall(destination, filter="data")


if __name__ == "__main__":
    unpack(Path(__file__).parent, Path("/workspace/source"))