from pathlib import Path
import tarfile,json,hashlib
base=Path(__file__).parent;stage=base/'stage';stage.mkdir(exist_ok=True)
lock=json.loads((base/'input-lock.json').read_text())
for item in lock:
 archive=base/'inputs'/item['name'];assert hashlib.file_digest(archive.open('rb'),'sha256').hexdigest()==item['sha256']
 dest=stage/item['name'].removesuffix('.tar.gz');dest.mkdir(exist_ok=True)
 with tarfile.open(archive) as tar:tar.extractall(dest,filter='data')
print('hashed source/tool archives extracted safely; no downloaded tool executed')