#!/usr/bin/env python3
"""Linux dummy-credential probe; consumes inherited descriptors, prints no bytes."""
import argparse
import fcntl
import os
import sys


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--master-key-fd", type=int, required=True)
    parser.add_argument("--signing-key-fd", type=int, required=True)
    args = parser.parse_args()
    if sys.platform != "linux":
        raise RuntimeError("sealed-descriptor observation requires Linux")
    descriptors = [args.master_key_fd, args.signing_key_fd]
    identities = set()
    required = fcntl.F_SEAL_SEAL | fcntl.F_SEAL_SHRINK | fcntl.F_SEAL_GROW | fcntl.F_SEAL_WRITE
    for descriptor in descriptors:
        metadata = os.fstat(descriptor)
        identities.add((metadata.st_dev, metadata.st_ino))
        if fcntl.fcntl(descriptor, fcntl.F_GET_SEALS) & required != required:
            raise RuntimeError("inherited credential is not fully sealed")
        if fcntl.fcntl(descriptor, fcntl.F_GETFL) & os.O_ACCMODE != os.O_RDONLY:
            raise RuntimeError("inherited credential is not read-only")
        if len(os.read(descriptor, 33)) != 32:
            raise RuntimeError("dummy credential must contain exactly 32 bytes")
        os.close(descriptor)
    if len(identities) != 2:
        raise RuntimeError("two roles received the same underlying credential")
    print("VERIFY two distinct 32-byte credentials: read-only, sealed, consumed and closed")


if __name__ == "__main__":
    main()