"""Isolated Ubuntu runtime for official CUDA binaries; no system modifications."""
import hashlib
import io
import json
from pathlib import Path
import tarfile
import urllib.request

import zstandard


def prepare_runtime(cache: Path) -> tuple[str, list[str]]:
    root = cache / "compat-runtime-v2"
    marker = root / ".ready"
    root.mkdir(parents=True, exist_ok=True)
    if not marker.exists():
        manifest = json.loads(
            Path(__file__).with_name("runtime-packages.json").read_text()
        )
        for package in manifest:
            bundled = Path(__file__).parent / "runtime-packages" / package["url"].rsplit("/", 1)[-1]
            if bundled.is_file():
                data = bundled.read_bytes()
            else:
                with urllib.request.urlopen(package["url"], timeout=90) as response:
                    data = response.read()
            if hashlib.sha256(data).hexdigest() != package["sha256"]:
                raise RuntimeError("Runtime package checksum mismatch")
            if not data.startswith(b"!<arch>\n"):
                raise RuntimeError("Invalid Debian package")
            offset = 8
            while offset + 60 <= len(data):
                header = data[offset : offset + 60]
                name = header[:16].decode().strip().rstrip("/")
                size = int(header[48:58].decode().strip())
                body = data[offset + 60 : offset + 60 + size]
                offset += 60 + size + size % 2
                if not name.startswith("data.tar"):
                    continue
                if name.endswith(".zst"):
                    with zstandard.ZstdDecompressor().stream_reader(io.BytesIO(body)) as r:
                        body = r.read()
                with tarfile.open(fileobj=io.BytesIO(body), mode="r:*") as archive:
                    for member in archive.getmembers():
                        if not member.isfile():
                            continue
                        relative = Path(member.name)
                        if relative.is_absolute() or ".." in relative.parts:
                            raise RuntimeError("Unsafe runtime package path")
                        target = root / relative
                        target.parent.mkdir(parents=True, exist_ok=True)
                        with archive.extractfile(member) as source:
                            target.write_bytes(source.read())
                        target.chmod(member.mode)
                break
        versions = [
            p for p in root.rglob("libstdc++.so.6.*")
            if p.is_file() and p.read_bytes()[:4] == b"\x7fELF"
        ]
        if versions:
            alias = versions[0].parent / "libstdc++.so.6"
            if not alias.exists():
                alias.symlink_to(versions[0].name)
        marker.touch()
    loaders = list(root.rglob("ld-linux-x86-64.so.2"))
    if not loaders:
        raise RuntimeError("Isolated dynamic loader missing")
    dirs = sorted({
        str(p.parent) for p in root.rglob("*.so*")
        if p.is_file() and p.read_bytes()[:4] == b"\x7fELF"
    })
    return str(loaders[0]), dirs