# Release notice tool tests

Run `python3 tests/release_notices/run.py` from the repository root. Uses Python's
standard library, isolated temporary fixtures and checked-in icon evidence; no managed package,
SDK, toolchain, PlatformIO, network, or device is required. Linux/POSIX path and
descriptor semantics match the notice tool.

Covers exact full-text/excerpt preservation and manifests; deterministic bytes
across moved roots/changed mtimes; missing, empty, changed and oversized inputs;
source body drift outside excerpts; bounds/schema; traversal and symlinks in
input/output ancestry; FIFOs/directories; existing user-data preservation;
explicit output requirement; unlisted secret/config/build exclusion; incomplete
write behavior; and success/failure CLI exits. Additional offline icon tests check
exact upstream SHA-256/Git blob identities, release and author metadata, absence
of NOTICE paths in the complete pinned tree, actual retained SVG coordinates,
USB mockup transforms, manual firmware row bytes, and catalog inclusion. A
changed coordinate or added transform is rejected; differing mockup Wi-Fi and
unproven manual rasterization are not described as exact upstream matches.

Real installed-input assembly is an explicit, separate offline check:

```sh
python3 tests/release_notices/actual_bundle.py \
  --sdk-root /home/mscholz/.platformio/packages/framework-espidf \
  --toolchain-root /home/mscholz/.platformio/packages/toolchain-xtensa-esp-elf
```

Use literal paths for the reviewed installed snapshot. This invokes the real
CLI twice with fresh temporary outputs outside input roots, verifies catalog
identity, every manifest entry and payload hash/size, absence of extra files,
and identical relative names/bytes across outputs. Temporary outputs are removed
after the check. No fetch, dependency installation, build or device access.
Recipient delivery remains separate; see `docs/release_packaging.md`. Passing
these tests is not license clearance or corresponding-source compliance.