# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/which-sbom-signatures-must-be-verified-when-the-build-environment-is-ephemeral.md
# Remnant Warrant:    https://corpusfetch.com/c/which-sbom-signatures-must-be-verified-when-the-build-environment-is-ephemeral.warrant.json
# Markdown SHA-256:   a7595bfe51a0fe8bc8777c95daa8a6e8dd204c4c60aaacaa6efa091e7e8744bb
# Code AST SHA-256:   fe87eea824ed3589b8847023233c516d562d6667d53f094b767b33b9b2df6000
# Verified Classes:   EphemeralBuilderVerdict, EphemeralSBOMPackage, EphemeralBuilderPolicy, EphemeralBuilderManifest, EphemeralBuilderGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class EphemeralBuilderVerdict(Enum):
    VERIFIED_EPHEMERAL = auto()
    NO_HARDWARE_ATTESTATION = auto()
    NO_TRANSPARENCY_PROOF = auto()

@dataclass(frozen=True)
class EphemeralSBOMPackage:
    sbom_hash: str
    hardware_attestation_quote: str | None
    transparency_log_proof: str | None
    builder_cert_chain_hash: str | None

@dataclass(frozen=True)
class EphemeralBuilderPolicy:
    trusted_tee_providers: frozenset[str]
    trusted_transparency_logs: frozenset[str]
    require_hardware_attestation: bool

@dataclass(frozen=True)
class EphemeralBuilderManifest:
    verdict: EphemeralBuilderVerdict
    directive: str
    manifest_digest: str

class EphemeralBuilderGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_ephemeral(
        cls, pkg: EphemeralSBOMPackage, policy: EphemeralBuilderPolicy
    ) -> EphemeralBuilderManifest:
        
        # Gate 1: Hardware attestation (if required)
        if policy.require_hardware_attestation and not pkg.hardware_attestation_quote:
            return EphemeralBuilderManifest(
                verdict=EphemeralBuilderVerdict.NO_HARDWARE_ATTESTATION,
                directive="HALT: Hardware attestation required but missing. Ephemeral builder cannot be verified.",
                manifest_digest=cls._hash(f"NO_TEE:{pkg.sbom_hash}")
            )

        # Gate 2: Transparency log
        if not pkg.transparency_log_proof:
            return EphemeralBuilderManifest(
                verdict=EphemeralBuilderVerdict.NO_TRANSPARENCY_PROOF,
                directive="HALT: No transparency log proof. Builder may have been compromised post-sign.",
                manifest_digest=cls._hash(f"NO_LOG:{pkg.sbom_hash}")
            )

        # Gate 3: Certificate chain
        if not pkg.builder_cert_chain_hash:
            return EphemeralBuilderManifest(
                verdict=EphemeralBuilderVerdict.NO_HARDWARE_ATTESTATION,
                directive="HALT: No builder certificate chain. Cannot verify builder identity.",
                manifest_digest=cls._hash(f"NO_CHAIN:{pkg.sbom_hash}")
            )

        # Gate 4: Verified
        digest = cls._hash(json.dumps({
            "sbom": pkg.sbom_hash,
            "attestation": pkg.hardware_attestation_quote or "NONE",
            "log_proof": pkg.transparency_log_proof,
            "cert_chain": pkg.builder_cert_chain_hash
        }, sort_keys=True))
        
        return EphemeralBuilderManifest(
            verdict=EphemeralBuilderVerdict.VERIFIED_EPHEMERAL,
            directive="PROCEED: Ephemeral build environment verified via hardware attestation and transparency log.",
            manifest_digest=digest
        )