import hashlib
import json
import tarfile
from remote import ROOT, run

local=ROOT/'error-evidence'
raw=run(['tar','-cf','-','-C','/storage/contextra/maintenance/fight-r5-errors-20261101-r01','shared','manifest.json'],sudo=True)
archive=local/'shared-evidence.tar';archive.write_bytes(raw);archive.chmod(0o600)
with tarfile.open(archive) as bundle:
    bundle.extractall(local,filter='data')
manifest=json.loads((local/'manifest.json').read_text())
for name,entry in manifest['files'].items():
    if name.startswith('shared/'):
        assert hashlib.sha256((local/name).read_bytes()).hexdigest()==entry['sha256']
print('Shared evidence SHA256 verified; private originals not copied.')