"""Install only the verified missing ACL utility; do not change any ACL yet."""
import hashlib
import os
from pathlib import Path
import shutil
import subprocess

if os.geteuid() != 0:
    raise SystemExit("sudo required")
if shutil.which("setfacl"):
    print("ACL utility already present; no package changed")
else:
    path = Path("/home/si/.local/share/contextra-offline-prep/20260928-r01/downloads/acl_2.3.2-1build1.1_amd64.deb")
    if hashlib.sha256(path.read_bytes()).hexdigest() != "0beec20d005bb4b3138ac9c99ab7c10a06acaf1ea1ad4e10ad760e56561edd58":
        raise SystemExit("Package digest mismatch")
    subprocess.run(["dpkg", "--install", str(path)], check=True, timeout=90,
                   env=dict(os.environ, DEBIAN_FRONTEND="noninteractive"))
    print("ACL utility installed; filesystem permissions unchanged")