@max_artifact_bytes 32 * 1_048_576

  @max_manifest_bytes 1_048_576

  @max_beam_bytes 4 * 1_048_576

  @max_modules 512

  @max_modules 2_048

  @manifest_keys ~w(schema build_id repo source_sha baseline toolchain classification structural_reasons changes modules)

  @toolchain_keys ~w(elixir otp erts application_version application_spec_sha256 mix_lock_sha256)

  @change_keys ~w(added changed deleted)

  @module_keys ~w(name sha256 size)

  @classification ~w(direct_candidate needs_rolling_replace)

  @module_pattern ~r/^Elixir\.OpenAgents(?:\.[A-Za-z][A-Za-z0-9_]*)+$/

  # Keep atom creation bounded to module namespaces owned by this OTP

  # application. The release contains the two application roots, generated

  # Inspect implementations, and Mix tasks in addition to OpenAgents.*.

  @module_pattern ~r/^Elixir\.(?:(?:OpenAgents|OpenAgentsWeb)(?:\.[A-Za-z][A-Za-z0-9_]*)*|Inspect\.(?:OpenAgents|OpenAgentsWeb)(?:\.[A-Za-z][A-Za-z0-9_]*)+|Mix\.Tasks\.(?:OpenAgents|Openagents)(?:\.[A-Za-z][A-Za-z0-9_]*)+)$/

  @type beam :: %{module: String.t(), binary: binary()}

  @type verified :: %{

    assert {:error, :invalid_artifact_entry} = BuildArtifact.verify(tar_bytes(traversal))

  end

  test "application-owned release module namespaces are admitted" do

    build_id = Ecto.UUID.generate()

    beams = [

      loaded_beam(OpenAgents),

      loaded_beam(OpenAgentsWeb),

      loaded_beam(Inspect.OpenAgents.Accounts.User),

      loaded_beam(Mix.Tasks.Openagents.Config.Readiness)

    ]

    assert {:ok, artifact} =

             BuildArtifact.pack(@repo, @sha, build_id, beams,

               toolchain: BuildArtifact.current_toolchain()

             )

    assert artifact.manifest["changes"]["added"] ==

             Enum.sort([

               "Elixir.Inspect.OpenAgents.Accounts.User",

               "Elixir.Mix.Tasks.Openagents.Config.Readiness",

               "Elixir.OpenAgents",

               "Elixir.OpenAgentsWeb"

             ])

  end

  defp compile_beam(suffix, value) do

    module = "OpenAgents.Scratch.#{suffix}"

    %{module: "Elixir." <> module, binary: binary}

  end

  defp loaded_beam(module) do

    assert {:module, ^module} = Code.ensure_loaded(module)

    {^module, binary, _path} = :code.get_object_code(module)

    %{module: Atom.to_string(module), binary: binary}

  end

  defp tar_bytes(entries) do

    path = Path.join(System.tmp_dir!(), "artifact-test-#{System.unique_integer([:positive])}.tar")

    :ok = :erl_tar.create(String.to_charlist(path), entries)