src/test/java/org/apache/commons/codec/digest/GitIdentifiersTest.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.commons.codec.digest;

import static org.junit.jupiter.api.Assertions.assertArrayEquals;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.attribute.PosixFilePermissions;
import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.stream.Stream;

import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Hex;
import org.apache.commons.codec.digest.GitIdentifiers.DirectoryEntry;
import org.junit.jupiter.api.Assumptions;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.io.TempDir;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import org.junit.jupiter.params.provider.ValueSource;

/**
 * Tests {@link GitIdentifiers}.
 */
class GitIdentifiersTest {

    private static final byte[] ZERO_ID = new byte[20];

    // Virtual tree:
    //
    // link      -> src           (symlink)
    // link.txt  -> src/hello.txt (symlink)
    // src/
    //   hello.txt                (regular file)
    //   run.sh                   (executable file)

    /** Content of {@code src/hello.txt}. */
    private static final byte[] HELLO_CONTENT = "hello\n".getBytes(StandardCharsets.UTF_8);
    /** SHA-1 blob id of {@link #HELLO_CONTENT}: {@code printf 'hello\n' | git hash-object --stdin} */
    private static final byte[] HELLO_BLOB_ID_SHA1 = hex("ce013625030ba8dba906f756967f9e9ca394464a");
    /** SHA-256 blob id of {@link #HELLO_CONTENT}. */
    private static final byte[] HELLO_BLOB_ID_SHA256 = hex("2cf8d83d9ee29543b34a87727421fdecb7e3f3a183d337639025de576db9ebb4");

    /** Content of {@code src/run.sh}. */
    private static final byte[] RUN_CONTENT = "#!/bin/sh\n".getBytes(StandardCharsets.UTF_8);
    /** SHA-1 blob id of {@link #RUN_CONTENT}: {@code printf '#!/bin/sh\n' | git hash-object --stdin} */
    private static final byte[] RUN_BLOB_ID_SHA1 = hex("1a2485251c33a70432394c93fb89330ef214bfc9");
    /** SHA-256 blob id of {@link #RUN_CONTENT}. */
    private static final byte[] RUN_BLOB_ID_SHA256 = hex("1249034e3cf9007362d695b09b1fbdb4c578903bf10b665749b94743f8177ce1");

    /** Target of symlink {@code link}. */
    private static final String LINK_CONTENT = "src";
    /** SHA-1 blob id of the symlink target {@link #LINK_CONTENT}: {@code printf 'src' | git hash-object --stdin} */
    private static final byte[] LINK_BLOB_ID_SHA1 = hex("e8310385c56dc4bbe379f43400f3181f6a59f260");
    /** SHA-256 blob id of the symlink target {@link #LINK_CONTENT}. */
    private static final byte[] LINK_BLOB_ID_SHA256 = hex("e1bdca538422554ea204da85e0cec156b12b6808473083610ff95ea390843ab6");

    /** Target of symlink {@code link.txt}. */
    private static final String LINK_TXT_CONTENT = "src/hello.txt";
    /** SHA-1 blob id of the symlink target {@link #LINK_TXT_CONTENT}: {@code printf 'src/hello.txt' | git hash-object --stdin} */
    private static final byte[] LINK_TXT_BLOB_ID_SHA1 = hex("132a953033e00dcff94f5cccb261f52cd1d71173");
    /** SHA-256 blob id of the symlink target {@link #LINK_TXT_CONTENT}. */
    private static final byte[] LINK_TXT_BLOB_ID_SHA256 = hex("2499925193a48a84a546a2f7cd3ce7789d4e073ef1e7276fe682bfbb2b636cef");

    // Tree ids can be recomputed in a git repository with:
    //   git init /tmp/t && cd /tmp/t
    // followed by writing the blob objects and calling git mktree.

    /**
     * SHA-1 tree id of {@code src/} (hello.txt + run.sh):
     * <pre>
     * printf '100644 blob ce013625030ba8dba906f756967f9e9ca394464a\thello.txt\n
     *         100755 blob 1a2485251c33a70432394c93fb89330ef214bfc9\trun.sh\n' | git mktree
     * </pre>
     */
    private static final byte[] SRC_TREE_ID_SHA1 = hex("5575b4a0141a2287ec2836a620e5d6aa8fb203ba");
    /**
     * SHA-256 tree id of {@code src/}:
     * <pre>
     * printf '100644 blob 2cf8d83d9ee29543b34a87727421fdecb7e3f3a183d337639025de576db9ebb4\thello.txt\n
     *         100755 blob 1249034e3cf9007362d695b09b1fbdb4c578903bf10b665749b94743f8177ce1\trun.sh\n' | git mktree
     * </pre>
     */
    private static final byte[] SRC_TREE_ID_SHA256 = hex("5b4e74befcb98e3050c511d02353d00565b2172be0a2bc5de833f011ad27f694");

    /**
     * SHA-1 tree id of the main directory (link + link.txt + src/):
     * <pre>
     * printf '120000 blob e8310385c56dc4bbe379f43400f3181f6a59f260\tlink\n
     *         120000 blob 132a953033e00dcff94f5cccb261f52cd1d71173\tlink.txt\n
     *         040000 tree 5575b4a0141a2287ec2836a620e5d6aa8fb203ba\tsrc\n' | git mktree
     * </pre>
     */
    private static final byte[] MAIN_TREE_ID_SHA1 = hex("3217900fd0a6624cd6aa169c2a9f289f7f34432b");
    /**
     * SHA-256 tree id of the main directory:
     * <pre>
     * printf '120000 blob e1bdca538422554ea204da85e0cec156b12b6808473083610ff95ea390843ab6\tlink\n
     *         120000 blob 2499925193a48a84a546a2f7cd3ce7789d4e073ef1e7276fe682bfbb2b636cef\tlink.txt\n
     *         040000 tree 5b4e74befcb98e3050c511d02353d00565b2172be0a2bc5de833f011ad27f694\tsrc\n' | git mktree
     * </pre>
     */
    private static final byte[] MAIN_TREE_ID_SHA256 = hex("58e9a59940e4d2ae7e374b63fedf3b7bba8cfdc60308f64abd066db137300bcd");

    static Stream<Arguments> blobIdProvider() {
        return Stream.of(Arguments.of("DigestUtilsTest/hello.txt", "5f4a83288e67f1be2d6fcdad84165a86c6a970d7"),
                Arguments.of("DigestUtilsTest/greetings.txt", "6cf4f797455661e61d1ee6913fc29344f5897243"),
                Arguments.of("DigestUtilsTest/subdir/nested.txt", "07a392ddb4dbff06a373a7617939f30b2dcfe719"));
    }

    /** Decodes a compile-time hex literal; throws {@link AssertionError} on malformed input. */
    private static byte[] hex(final String hex) {
        try {
            return Hex.decodeHex(hex);
        } catch (final DecoderException e) {
            throw new AssertionError(e);
        }
    }

    private static Path resourcePath(final String resourceName) throws Exception {
        return Paths.get(GitIdentifiersTest.class.getClassLoader().getResource(resourceName).toURI());
    }

    static Stream<Arguments> virtualTreeProvider() {
        return Stream.of(
                Arguments.of(MessageDigestAlgorithms.SHA_1, HELLO_BLOB_ID_SHA1, LINK_BLOB_ID_SHA1, LINK_TXT_BLOB_ID_SHA1, RUN_BLOB_ID_SHA1,
                        SRC_TREE_ID_SHA1, MAIN_TREE_ID_SHA1),
                Arguments.of(MessageDigestAlgorithms.SHA_256, HELLO_BLOB_ID_SHA256, LINK_BLOB_ID_SHA256, LINK_TXT_BLOB_ID_SHA256, RUN_BLOB_ID_SHA256,
                        SRC_TREE_ID_SHA256, MAIN_TREE_ID_SHA256));
    }

    @ParameterizedTest
    @MethodSource("blobIdProvider")
    void testBlobIdByteArray(final String resourceName, final String expectedSha1Hex) throws Exception {
        final byte[] data = Files.readAllBytes(resourcePath(resourceName));
        assertArrayEquals(Hex.decodeHex(expectedSha1Hex), GitIdentifiers.blobId(DigestUtils.getSha1Digest(), data));
    }

    @ParameterizedTest
    @ValueSource(ints = { 0, 1, 8191, 8192, 8193, 20000 })
    void testBlobIdInputStreamLengths(final int length) throws IOException {
        final byte[] data = new byte[length];
        Arrays.fill(data, (byte) 42);
        assertArrayEquals(GitIdentifiers.blobId(DigestUtils.getSha1Digest(), data),
                GitIdentifiers.blobId(DigestUtils.getSha1Digest(), length, new ByteArrayInputStream(data)));
        for (final long declaredSize : new long[] { -1, length - 1L, length + 1L }) {
            assertThrows(IOException.class, () -> GitIdentifiers.blobId(DigestUtils.getSha1Digest(), declaredSize, new ByteArrayInputStream(data)));
        }
    }

    @ParameterizedTest
    @MethodSource("blobIdProvider")
    void testBlobIdInputStreamWithSize(final String resourceName, final String expectedSha1Hex) throws Exception {
        final byte[] data = Files.readAllBytes(resourcePath(resourceName));
        assertArrayEquals(Hex.decodeHex(expectedSha1Hex),
                GitIdentifiers.blobId(DigestUtils.getSha1Digest(), data.length, new ByteArrayInputStream(data)));
    }

    @ParameterizedTest
    @MethodSource("blobIdProvider")
    void testBlobIdPath(final String resourceName, final String expectedSha1Hex) throws Exception {
        assertArrayEquals(Hex.decodeHex(expectedSha1Hex), GitIdentifiers.blobId(DigestUtils.getSha1Digest(), resourcePath(resourceName)));
    }

    @Test
    void testBlobIdSymlink(@TempDir final Path tempDir) throws Exception {
        final Path subDir = Files.createDirectory(tempDir.resolve("subdir"));
        Files.write(subDir.resolve("file.txt"), "hello".getBytes(StandardCharsets.UTF_8));
        try {
            final Path linkToDir = Files.createSymbolicLink(tempDir.resolve("link-to-dir"), Paths.get("subdir"));
            final Path linkToFile = Files.createSymbolicLink(tempDir.resolve("link-to-file"), Paths.get("subdir/file.txt"));
            final MessageDigest sha1 = DigestUtils.getSha1Digest();
            assertArrayEquals(Hex.decodeHex("8bbe8a53790056316b23b7c270f10ab6bf6bb1b4"), GitIdentifiers.blobId(sha1, linkToDir));
            assertArrayEquals(Hex.decodeHex("dfe6ef8392ae13a11ff85419b4fd906d997b6cb7"), GitIdentifiers.blobId(sha1, linkToFile));
        } catch (final UnsupportedOperationException e) {
            Assumptions.abort("Symbolic links not supported on this filesystem");
        }
    }

    @Test
    void testDirectoryEntryConstructor() {
        assertThrows(NullPointerException.class, () -> new DirectoryEntry(null, GitIdentifiers.FileMode.REGULAR, ZERO_ID));
        assertThrows(NullPointerException.class, () -> new DirectoryEntry("hello.txt", null, ZERO_ID));
        assertThrows(NullPointerException.class, () -> new DirectoryEntry("hello.txt", GitIdentifiers.FileMode.REGULAR, null));
        assertThrows(IllegalArgumentException.class, () -> new DirectoryEntry("/", GitIdentifiers.FileMode.REGULAR, ZERO_ID));
    }

    /**
     * Equality and hash code are based solely on the entry name.
     */
    @Test
    void testDirectoryEntryEqualityBasedOnNameOnly() {
        final byte[] otherId = new byte[20];
        Arrays.fill(otherId, (byte) 0xff);
        final DirectoryEntry regular = new DirectoryEntry("foo", GitIdentifiers.FileMode.REGULAR, ZERO_ID);
        final DirectoryEntry executable = new DirectoryEntry("foo", GitIdentifiers.FileMode.EXECUTABLE, otherId);
        // Same name, different type and object id -> equal
        assertEquals(regular, executable);
        assertEquals(regular.hashCode(), executable.hashCode());
        // Different name -> not equal
        assertNotEquals(regular, new DirectoryEntry("bar", GitIdentifiers.FileMode.REGULAR, ZERO_ID));
        // Same reference -> equal
        assertEquals(regular, regular);
        // Not equal to null or unrelated type
        assertFalse(regular.equals(null));
        assertFalse(regular.equals("foo"));
    }

    /**
     * Entries should be sorted by Git sort rule.
     *
     * <p>
     * Git compares the names of the entries, but adds a {@code /} at the end of directory entries.
     * </p>
     */
    @Test
    void testDirectoryEntrySortOrder() {
        final DirectoryEntry alpha = new DirectoryEntry("alpha.txt", GitIdentifiers.FileMode.REGULAR, ZERO_ID);
        final DirectoryEntry fooTxt = new DirectoryEntry("foo.txt", GitIdentifiers.FileMode.REGULAR, ZERO_ID);
        final DirectoryEntry fooDir = new DirectoryEntry("foo", GitIdentifiers.FileMode.DIRECTORY, ZERO_ID);
        final DirectoryEntry foobar = new DirectoryEntry("foobar", GitIdentifiers.FileMode.REGULAR, ZERO_ID);
        final DirectoryEntry zeta = new DirectoryEntry("zeta.txt", GitIdentifiers.FileMode.REGULAR, ZERO_ID);
        final List<DirectoryEntry> entries = new ArrayList<>(Arrays.asList(zeta, foobar, fooDir, alpha, fooTxt));
        entries.sort(DirectoryEntry::compareTo);
        assertEquals(Arrays.asList(alpha, fooTxt, fooDir, foobar, zeta), entries);
    }

    @ParameterizedTest
    @ValueSource(strings = {"..", "bad\0dir", "\uD800", "\uDC00"})
    void testRejectsInvalidDirectoryNames(final String name) {
        final GitIdentifiers.TreeIdBuilder builder = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        assertThrows(IllegalArgumentException.class, () -> builder.addDirectory("parent/" + name));
        assertThrows(IllegalArgumentException.class, () -> builder.addFile(GitIdentifiers.FileMode.REGULAR, name + "/file", HELLO_CONTENT));
    }

    @ParameterizedTest
    @ValueSource(strings = {"", ".", "..", "a\0b", "\uD800", "\uDC00", "a\uD800b", "\uD800\uD800", "\uDC00\uD800"})
    void testRejectsInvalidEntryNames(final String name) {
        assertThrows(IllegalArgumentException.class, () -> new DirectoryEntry(name, GitIdentifiers.FileMode.REGULAR, ZERO_ID));
        final GitIdentifiers.TreeIdBuilder builder = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        assertThrows(IllegalArgumentException.class, () -> builder.addFile(GitIdentifiers.FileMode.REGULAR, name, HELLO_CONTENT));
        assertThrows(IllegalArgumentException.class,
                () -> builder.addFile(GitIdentifiers.FileMode.REGULAR, name, HELLO_CONTENT.length, new ByteArrayInputStream(HELLO_CONTENT)));
        assertThrows(IllegalArgumentException.class, () -> builder.addSymbolicLink(name, "target"));
    }

    @ParameterizedTest
    @ValueSource(strings = {"?", "a\nb", "\uD83D\uDE00"})
    void testTreeIdAcceptsValidEntryNames(final String name) throws Exception {
        final GitIdentifiers.TreeIdBuilder builder = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        builder.addFile(GitIdentifiers.FileMode.REGULAR, name, HELLO_CONTENT);
        assertEquals(20, builder.get().length);
        final GitIdentifiers.TreeIdBuilder directory = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        directory.addDirectory(name).addFile(GitIdentifiers.FileMode.REGULAR, "file", HELLO_CONTENT);
        assertEquals(20, directory.get().length);
    }

    @ParameterizedTest
    @MethodSource("virtualTreeProvider")
    void testTreeIdBuilder(final String algorithm, final byte[] helloId, final byte[] linkId, final byte[] linkTxtId, final byte[] runId,
            final byte[] srcTreeId, final byte[] mainTreeId) throws Exception {
        final MessageDigest md = DigestUtils.getDigest(algorithm);

        // Verify individual blob IDs against pre-computed constants.
        assertArrayEquals(helloId, GitIdentifiers.blobId(md, HELLO_CONTENT));
        assertArrayEquals(linkId, GitIdentifiers.blobId(md, LINK_CONTENT.getBytes(StandardCharsets.UTF_8)));
        assertArrayEquals(linkTxtId, GitIdentifiers.blobId(md, LINK_TXT_CONTENT.getBytes(StandardCharsets.UTF_8)));
        assertArrayEquals(runId, GitIdentifiers.blobId(md, RUN_CONTENT));

        // Entries are supplied out of order to verify that the builder sorts them correctly.
        final GitIdentifiers.TreeIdBuilder builder = GitIdentifiers.treeIdBuilder(md);
        builder.addSymbolicLink("link.txt", LINK_TXT_CONTENT);
        builder.addFile(GitIdentifiers.FileMode.REGULAR, "src/hello.txt", HELLO_CONTENT);
        builder.addSymbolicLink("link", LINK_CONTENT);
        builder.addFile(GitIdentifiers.FileMode.EXECUTABLE, "src/run.sh", RUN_CONTENT);

        // Check trees
        assertArrayEquals(mainTreeId, builder.get());
        assertArrayEquals(srcTreeId, builder.addDirectory("src").get());
    }

    @Test
    void testTreeIdBuilderAddFileInputStream() throws Exception {
        final MessageDigest md = DigestUtils.getSha1Digest();
        final byte[] content = "Hello, World!\n".getBytes(StandardCharsets.UTF_8);

        final GitIdentifiers.TreeIdBuilder byteArrayBuilder = GitIdentifiers.treeIdBuilder(md);
        byteArrayBuilder.addFile(GitIdentifiers.FileMode.REGULAR, "file.txt", content);
        final byte[] expected = byteArrayBuilder.get();

        final GitIdentifiers.TreeIdBuilder sizedStreamBuilder = GitIdentifiers.treeIdBuilder(md);
        sizedStreamBuilder.addFile(GitIdentifiers.FileMode.REGULAR, "file.txt", content.length, new ByteArrayInputStream(content));
        assertArrayEquals(expected, sizedStreamBuilder.get());
    }

    @Test
    void testTreeIdBuilderInvalidPathSegments() {
        final MessageDigest md = DigestUtils.getSha1Digest();
        final byte[] data = {};
        // Sole path component
        assertThrows(IllegalArgumentException.class,
                () -> GitIdentifiers.treeIdBuilder(md).addFile(GitIdentifiers.FileMode.REGULAR, "..", data));
        assertThrows(IllegalArgumentException.class,
                () -> GitIdentifiers.treeIdBuilder(md).addDirectory(".."));
        // Embedded in a longer path
        assertThrows(IllegalArgumentException.class,
                () -> GitIdentifiers.treeIdBuilder(md).addFile(GitIdentifiers.FileMode.REGULAR, "subdir/../file.txt", data));
        assertThrows(IllegalArgumentException.class,
                () -> GitIdentifiers.treeIdBuilder(md).addDirectory("subdir/.."));
    }

    @Test
    void testTreeIdBuilderNestedFileEquivalentToDirectoryAndFile() throws Exception {
        final MessageDigest md = DigestUtils.getSha1Digest();
        final byte[] content = "hello\n".getBytes(StandardCharsets.UTF_8);

        final GitIdentifiers.TreeIdBuilder direct = GitIdentifiers.treeIdBuilder(md);
        direct.addFile(GitIdentifiers.FileMode.REGULAR, "nested/file.txt", content);

        final GitIdentifiers.TreeIdBuilder indirect = GitIdentifiers.treeIdBuilder(md);
        indirect.addDirectory("nested").addFile(GitIdentifiers.FileMode.REGULAR, "file.txt", content);

        assertArrayEquals(direct.get(), indirect.get());
    }

    @ParameterizedTest
    @ValueSource(strings = {"", "."})
    void testTreeIdBuilderNoopPathSegments(final String segment) throws Exception {
        final MessageDigest md = DigestUtils.getSha1Digest();
        final byte[] content = "hello\n".getBytes(StandardCharsets.UTF_8);

        // Canonical form
        final GitIdentifiers.TreeIdBuilder canonical = GitIdentifiers.treeIdBuilder(md);
        canonical.addFile(GitIdentifiers.FileMode.REGULAR, "subdir/file.txt", content);
        final byte[] expected = canonical.get();

        // Leading segment
        final GitIdentifiers.TreeIdBuilder withLeading = GitIdentifiers.treeIdBuilder(md);
        withLeading.addFile(GitIdentifiers.FileMode.REGULAR, segment + "/subdir/file.txt", content);
        assertArrayEquals(expected, withLeading.get());

        // Intermediate segment
        final GitIdentifiers.TreeIdBuilder withIntermediate = GitIdentifiers.treeIdBuilder(md);
        withIntermediate.addFile(GitIdentifiers.FileMode.REGULAR, "subdir/" + segment + "/file.txt", content);
        assertArrayEquals(expected, withIntermediate.get());

        // addDirectory with leading/trailing segments
        final GitIdentifiers.TreeIdBuilder viaDirectory = GitIdentifiers.treeIdBuilder(md);
        viaDirectory.addDirectory(segment + "/subdir/" + segment).addFile(GitIdentifiers.FileMode.REGULAR, "file.txt", content);
        assertArrayEquals(expected, viaDirectory.get());
    }

    @ParameterizedTest
    @ValueSource(longs = { -1, 0, 5, 7 })
    void testTreeIdBuilderRejectsWrongStreamSize(final long declaredSize) throws IOException {
        final GitIdentifiers.TreeIdBuilder builder = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        builder.addFile(GitIdentifiers.FileMode.REGULAR, "hello.txt", HELLO_CONTENT);
        final byte[] expected = builder.get();
        assertThrows(IOException.class,
                () -> builder.addFile(GitIdentifiers.FileMode.REGULAR, "hello.txt", declaredSize, new ByteArrayInputStream(HELLO_CONTENT)));
        assertArrayEquals(expected, builder.get());
    }

    @Test
    void testTreeIdPath() throws Exception {
        assertArrayEquals(Hex.decodeHex("e4b21f6d78ceba6eb7c211ac15e3337ec4614e8a"),
                GitIdentifiers.treeId(DigestUtils.getSha1Digest(), resourcePath("DigestUtilsTest")));
    }

    @ParameterizedTest
    @MethodSource("virtualTreeProvider")
    void testTreeIdPathUnix(final String algorithm, final byte[] helloId, final byte[] linkId, final byte[] linkTxtId,
            final byte[] runId, final byte[] srcTreeId, final byte[] mainTreeId, final @TempDir Path tempDir) throws Exception {
        final MessageDigest md = DigestUtils.getDigest(algorithm);

        // Files
        final Path link = tempDir.resolve("link");
        final Path linkTxt = tempDir.resolve("link.txt");
        final Path src = tempDir.resolve("src");
        final Path hello = src.resolve("hello.txt");
        final Path run = src.resolve("run.sh");

        // Create the same structure as the virtual tree.
        try {
            Files.createSymbolicLink(link, Paths.get(LINK_CONTENT));
            Files.createSymbolicLink(linkTxt, Paths.get(LINK_TXT_CONTENT));
        } catch (final UnsupportedOperationException e) {
            Assumptions.abort("Symbolic links not supported on this filesystem");
        }
        Files.createDirectory(src);
        Files.write(hello, HELLO_CONTENT);
        Files.write(run, RUN_CONTENT);
        Files.setPosixFilePermissions(run, PosixFilePermissions.fromString("rwxr-xr-x"));

        // Verify individual blob IDs against pre-computed constants.
        assertArrayEquals(helloId, GitIdentifiers.blobId(md, hello));
        assertArrayEquals(linkId, GitIdentifiers.blobId(md, link));
        assertArrayEquals(linkTxtId, GitIdentifiers.blobId(md, linkTxt));
        assertArrayEquals(runId, GitIdentifiers.blobId(md, run));

        // Check trees
        assertArrayEquals(mainTreeId, GitIdentifiers.treeId(md, tempDir));
        assertArrayEquals(srcTreeId, GitIdentifiers.treeId(md, src));
    }

    @ParameterizedTest
    @ValueSource(strings = {"x", "parent/x"})
    void testTreeIdRejectsFileDirectoryConflicts(final String name) throws Exception {
        final GitIdentifiers.TreeIdBuilder fileFirst = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        fileFirst.addFile(GitIdentifiers.FileMode.REGULAR, name, HELLO_CONTENT);
        fileFirst.addDirectory(name);
        assertThrows(IllegalStateException.class, fileFirst::get);
        final GitIdentifiers.TreeIdBuilder directoryFirst = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        directoryFirst.addDirectory(name);
        directoryFirst.addSymbolicLink(name, "target");
        assertThrows(IllegalStateException.class, directoryFirst::get);
    }

    @Test
    void testTreeIdRejectsNulSerializationCollision() throws Exception {
        final MessageDigest md = DigestUtils.getSha1Digest();
        final byte[] a = "2161978".getBytes(StandardCharsets.UTF_8);
        final byte[] b = "payload".getBytes(StandardCharsets.UTF_8);
        final byte[] blobId = GitIdentifiers.blobId(md, a);
        assertEquals("615d6b396b134e0c1a617b0b7050632d627d154f", Hex.encodeHexString(blobId));
        final GitIdentifiers.TreeIdBuilder legitimate = GitIdentifiers.treeIdBuilder(md);
        legitimate.addFile(GitIdentifiers.FileMode.REGULAR, "a", a);
        legitimate.addFile(GitIdentifiers.FileMode.REGULAR, "b", b);
        assertEquals("cb1e930df28b6dc3ab8933ff7a8d233f1c189460", Hex.encodeHexString(legitimate.get()));
        // Without validation this single entry serializes identically to the legitimate two-entry tree.
        final String forgedName = "a\0" + new String(blobId, StandardCharsets.UTF_8) + "100644 b";
        final GitIdentifiers.TreeIdBuilder forged = GitIdentifiers.treeIdBuilder(md);
        assertThrows(IllegalArgumentException.class, () -> forged.addFile(GitIdentifiers.FileMode.REGULAR, forgedName, b));
    }

    @Test
    void testTreeIdRejectsTrailingSlash() {
        final GitIdentifiers.TreeIdBuilder builder = GitIdentifiers.treeIdBuilder(DigestUtils.getSha1Digest());
        assertThrows(IllegalArgumentException.class, () -> builder.addFile(GitIdentifiers.FileMode.REGULAR, "dir/", HELLO_CONTENT));
    }

    /**
     * Tree entry names are ordered by their UTF-8 bytes, which is not the order {@link String#compareTo(String)} gives when a supplementary character meets a
     * Basic Multilingual Plane character from U+E000 up: U+FF21 encodes to {@code EF BC A1} and U+1F600 to {@code F0 9F 98 80}, so Git sorts U+FF21 first, while
     * the UTF-16 code units place the surrogate pair of U+1F600 first.
     *
     * <p>
     * The expected identifier is the one {@code git write-tree} produces for a tree holding the same two entries.
     * </p>
     */
    @Test
    void testTreeIdSortsSupplementaryPlaneNamesLikeGit(@TempDir final Path tempDir) throws Exception {
        final String fullWidthA = "\uFF21";
        final String grinningFace = "\uD83D\uDE00";
        final byte[] content = "x".getBytes(StandardCharsets.UTF_8);
        final String expected = "9f9c1fc3580195f51d3e71b384ef1d57740e2151";
        final MessageDigest md = DigestUtils.getSha1Digest();

        // Entries are added in the wrong order on purpose, so only the sort decides the result.
        final GitIdentifiers.TreeIdBuilder builder = GitIdentifiers.treeIdBuilder(md);
        builder.addFile(GitIdentifiers.FileMode.REGULAR, grinningFace, content);
        builder.addFile(GitIdentifiers.FileMode.REGULAR, fullWidthA, content);
        assertEquals(expected, Hex.encodeHexString(builder.get()));

        try {
            Files.write(tempDir.resolve(fullWidthA), content);
            Files.write(tempDir.resolve(grinningFace), content);
        } catch (final IOException e) {
            Assumptions.abort("Filesystem cannot hold the test entry names: " + e);
        }
        assertEquals(expected, Hex.encodeHexString(GitIdentifiers.treeId(md, tempDir)));
    }
}