XFESystem

function Assert-XfeNativeEntropyPort([string]$Root,$Binding) {
    if(!$Binding -or !$Binding.ReceiptPath -or !$Binding.BouncyCastlePath -or !$Binding.AdapterPath) {throw 'The native BC entropy binding is missing.'}
    foreach($pair in @(@('ReceiptPath','ReceiptSha256'),@('BouncyCastlePath','BouncyCastleSha256'),@('AdapterPath','AdapterSha256'))) {
        $path=[string]$Binding.($pair[0]); $hash=[string]$Binding.($pair[1])
        [void](Get-RuntimeRelativeInput $Root $path)
        if($hash -cnotmatch '^[a-f0-9]{64}$' -or (Get-RuntimeInputHash $path) -cne $hash) {throw ('Native BC entropy artifact differs: '+$pair[0])}
    }
    $receipt=Get-Content -LiteralPath $Binding.ReceiptPath -Raw -Encoding UTF8 | ConvertFrom-Json
    if($receipt.Kind -cne 'XfeNativeBouncyCastleEntropyPortV1' -or $receipt.BeforeSha256 -cne 'ef92fc661e8d7ba8ec4d39a7cdfcdba41f14cb327f0d24fe79d0b5bb428899b5' -or
       $receipt.AfterSha256 -cne $Binding.BouncyCastleSha256 -or $receipt.AdapterSha256 -cne $Binding.AdapterSha256 -or
       $receipt.CallCount -ne 12 -or @($receipt.Calls).Count -ne 12 -or $receipt.MethodsAudited -lt 1 -or $receipt.OnlyEntropyCallsChanged -ne $true -or
       $receipt.GlobalPackageCacheModified -ne $false -or $receipt.CryptoPolicyModified -ne $false -or $receipt.HostRandomFallback -ne $false -or
       $receipt.OpenSslInitializationEmulated -ne $false -or $receipt.GuestAcceptancePassed -ne $false) {throw 'The explicit native BC entropy policy receipt is invalid.'}
    if(!$receipt.SourceSha256 -or @($receipt.SourceSha256.PSObject.Properties).Count -lt 7) {throw 'The native entropy tool source map is incomplete.'}
    foreach($entry in $receipt.SourceSha256.PSObject.Properties) {
        $path=Join-Path $Root $entry.Name
        if((Get-RuntimeInputHash $path) -cne $entry.Value) {throw ('Native entropy source differs: '+$entry.Name)}
    }
    return $Binding
}