ManifestWriter.java

// SPDX-License-Identifier: Apache-2.0

// Copyright 2026 Egothor

// Copyright 2026 Accenture

package org.egothor.methodatlas.evidence;

import java.io.BufferedWriter;

import java.io.IOException;

import java.io.InputStream;

import java.nio.charset.StandardCharsets;

import java.nio.file.Files;

import java.nio.file.Path;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.util.ArrayList;

import java.util.Collections;

import java.util.HexFormat;

import java.util.List;

import java.util.stream.Stream;

/**

 * Builds the {@code manifest.sha256} file that anchors an evidence pack.

 *

 * <p>

 * The manifest enumerates every file in the pack directory other than

 * itself and any {@code .signed} sibling, listing one entry per line in the

 * format {@code <hex-digest>  <filename>}. Files are sorted lexicographically

 * by filename so the manifest is byte-stable between runs that produce the

 * same artefacts.

 * </p>

 *

 * <p>

 * Package-private because nothing outside the evidence module needs to call

 * this writer.

 * </p>

 */

final class ManifestWriter {

    /** Java standard digest algorithm name for SHA-256. */

    private static final String DIGEST_ALGORITHM = "SHA-256";

    /** Buffer size used when streaming files through the digest. */

    private static final int BUFFER_SIZE = 8192;

    /** Filename suffix marking a signed-envelope sibling that must be excluded. */

    private static final String SIGNED_SUFFIX = ".signed";

    /** Two-space separator required by the shasum/coreutils manifest format. */

    private static final String SEPARATOR = "  ";

        // Utility class — instantiation makes no sense.

    /**

     * Writes a SHA-256 manifest of every regular file in {@code dir}, except

     * {@code manifestFile} itself and any file whose name ends with

     * {@code .signed}.

     *

     * @param dir          directory to enumerate; must exist

     * @param manifestFile output path; overwritten if it already exists

     * @throws IOException if directory listing, digest computation, or

     *                     writing fails

     */

    /* default */ static void write(Path dir, Path manifestFile) throws IOException {

    /**

     * Returns the filename portion of {@code p} as a non-null string. Used

     * defensively because {@link Path#getFileName()} can theoretically

     * return {@code null} (root paths); inside {@link Files#list(Path)}

     * results that case is unreachable, but SpotBugs flags the chained

     * {@code toString()} on a possibly-null return.

     *

     * @param p path to inspect

     * @return filename as string; never {@code null}

     */

    private static String filenameOf(Path p) {

    }

    /**

     * Lists candidate files in lexicographic order.

     *

     * @param dir          directory to enumerate

     * @param manifestFile manifest path to exclude

     * @return sorted list of files eligible for inclusion

     * @throws IOException if the directory cannot be listed

     */

    private static List<Path> collectFiles(Path dir, Path manifestFile) throws IOException {

    }

    /**

     * Computes a lowercase-hex SHA-256 digest of the supplied file.

     *

     * @param file path to digest

     * @return 64-character lowercase hex string

     * @throws IOException if reading fails or SHA-256 is unavailable

     */

    private static String sha256Hex(Path file) throws IOException {

            int read;

            }

    }

    /**

     * Creates a fresh SHA-256 digest, wrapping the checked exception into an

     * {@link IOException} so callers do not need a separate catch clause.

     *

     * @return new {@link MessageDigest} instance

     * @throws IOException when SHA-256 is unexpectedly unavailable (never on a

     *                     standard JDK)

     */

    private static MessageDigest newDigest() throws IOException {

        try {

        }

    }

}

Mutations

3.3
Location : filenameOf
Killed by : none removed conditional - replaced equality check with false → SURVIVED Covering tests

1.1
Location : lambda$collectFiles$0
Killed by : none replaced boolean return with true for org/egothor/methodatlas/evidence/ManifestWriter::lambda$collectFiles$0 → SURVIVED Covering tests

2.2
Location : lambda$collectFiles$0
Killed by : org.egothor.methodatlas.evidence.ManifestWriterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.evidence.ManifestWriterTest]/[method:writeExcludesManifestAndSignedSiblings(java.nio.file.Path)] replaced boolean return with false for org/egothor/methodatlas/evidence/ManifestWriter::lambda$collectFiles$0 → KILLED

2.2
Location : sha256Hex
Killed by : none changed conditional boundary → SURVIVED Covering tests

3.3
Location : sha256Hex
Killed by : org.egothor.methodatlas.evidence.ManifestWriterTest.[engine:junit-jupiter]/[class:org.egothor.methodatlas.evidence.ManifestWriterTest]/[method:writeExcludesManifestAndSignedSiblings(java.nio.file.Path)] removed conditional - replaced comparison check with true → KILLED