#!/usr/bin/env python3
"""Use only the source package's checksum-verified vendored Rust dependencies."""
import hashlib,json
from pathlib import Path
for manifest in Path('debian/vendor').glob('*/.cargo-checksum.json'):
    for name,expected in json.loads(manifest.read_text())['files'].items():
        path=manifest.parent/name
        with path.open('rb') as stream:actual=hashlib.file_digest(stream,'sha256').hexdigest()
        if actual!=expected:raise ValueError('Vendor checksum changed: '+str(path))
home=Path('debian/cargo-home');home.mkdir(exist_ok=True)
(home/'config.toml').write_text('[source.crates-io]\nreplace-with="vendored"\n[source.vendored]\ndirectory="'+str(Path('debian/vendor').resolve())+'"\n[net]\noffline=true\n')