Update upstream source from tag 'upstream/1.0'

Update to upstream version '1.0'
with Debian dir 1e26108ec9cb2f9b4e35e048ea8f73345a415680

9 files changed, 837 insertions, 0 deletions

diff --git a/tests/source-package-example/.reuse/dep5 b/tests/source-package-example/.reuse/dep5
new file mode 100644
index 0000000..9091060
--- /dev/null
+++ b/tests/source-package-example/.reuse/dep5
@@ -0,0 +1,10 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: Hydrilla source package example
+Upstream-Contact: Wojtek Kosior <koszko@koszko.org>
+Source: https://git.koszko.org/hydrilla-source-package-example
+
+# Sample paragraph, commented out:
+#
+# Files: src/*
+# Copyright: $YEAR $NAME <$CONTACT>
+# License: ...
diff --git a/tests/source-package-example/LICENSES/CC0-1.0.txt b/tests/source-package-example/LICENSES/CC0-1.0.txt
new file mode 100644
index 0000000..0e259d4
--- /dev/null
+++ b/tests/source-package-example/LICENSES/CC0-1.0.txt
@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.
diff --git a/tests/source-package-example/README.txt b/tests/source-package-example/README.txt
new file mode 100644
index 0000000..c6d5da2
--- /dev/null
+++ b/tests/source-package-example/README.txt
@@ -0,0 +1,2 @@
+This is a sample Hydrilla source package. Hydrilla builder can be used to build
+it for distribution.
diff --git a/tests/source-package-example/README.txt.license b/tests/source-package-example/README.txt.license
new file mode 100644
index 0000000..c02cd58
--- /dev/null
+++ b/tests/source-package-example/README.txt.license
@@ -0,0 +1,3 @@
+SPDX-License-Identifier: CC0-1.0
+
+Copyright (C) 2022 Wojtek Kosior <koszko@koszko.org>
diff --git a/tests/source-package-example/bye.js b/tests/source-package-example/bye.js
new file mode 100644
index 0000000..fcd0fdc
--- /dev/null
+++ b/tests/source-package-example/bye.js
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: CC0-1.0
+
+// Copyright (C) 2021 Wojtek Kosior <koszko@koszko.org>
+//
+// Available under the terms of Creative Commons Zero v1.0 Universal.
+
+console.log(bye_message + "apple!");
diff --git a/tests/source-package-example/hello.js b/tests/source-package-example/hello.js
new file mode 100644
index 0000000..46c0148
--- /dev/null
+++ b/tests/source-package-example/hello.js
@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: CC0-1.0
+
+// Copyright (C) 2021 Wojtek Kosior <koszko@koszko.org>
+//
+// Available under the terms of Creative Commons Zero v1.0 Universal.
+
+console.log(hello_message + "apple!");
diff --git a/tests/source-package-example/index.json b/tests/source-package-example/index.json
new file mode 100644
index 0000000..7162dd7
--- /dev/null
+++ b/tests/source-package-example/index.json
@@ -0,0 +1,207 @@
+// SPDX-License-Identifier: CC0-1.0
+
+// Copyright (C) 2021, 2022 Wojtek Kosior <koszko@koszko.org>
+// Available under the terms of Creative Commons Zero v1.0 Universal.
+
+// This is an example index.json file describing Hydrilla site content. As you
+// can see, for storing site content information Hydrilla utilizes JSON with an
+// additional extension in the form of '//' comments support.
+
+// An index.json file conveys definitions of site resources and pattern->payload
+// mappings. The definitions may reference files under index.json's containing
+// directory, using relative paths. This is how scripts, license texts, etc. are
+// included.
+// File reference always takes the form of an object with "file" property
+// specifying path to the file. In certain contexts additional properties may be
+// allowed or required. Unix paths (using '/' as separator) are assumed. It is
+// not allowed for an index.json file to reference files outside its directory.
+
+// Certain objects are allowed to contain a "comment" field. Although '//'
+// comments can be used in index.json files, they will not be included in
+// generated JSON definitions. If a comment should be included in the
+// definitions served by Hydrilla API, it should be put in a "comment" field of
+// the proper object.
+
+// Unknown object properties will be ignored. This is for compatibility with
+// possible future revisions of the format.
+{
+    // Once our index.json schema changes, this field's value will change. Our
+    // software will be able to handle both current and older formats thanks to
+    // this information present in every index.json file. Schemas that differ by
+    // the first (major) number are always incompatible (e.g. a Hydrilla builder
+    // instance released at the time of 1.2 being the most recent schema version
+    // will not understand version 2.1).
+    // Schemas that are backwards-compatible will have the same major number
+    // and might differ by the second (minor) version number. The third (patch)
+    // and subsequent numbers are being ignored right now.
+    "$schema": "https://hydrilla.koszko.org/schemas/package_source-1.schema.json",
+
+    // Used when referring to this source package. Should be consize, unique
+    // (among other source package names) and can only use a restricted set of
+    // characters. It has to match: [-0-9a-z.]+
+    "source_name": "hello",
+
+    // This property lists files that contain copyright information regarding
+    // this source package as well as texts of licenses used. Although no
+    // specific format of these files is mandated, it is recommended to make
+    // each source package REUSE-compliant, generate an spdx report for it as
+    // `report.spdx` and list this report together with all license files here.
+    "copyright":  [
+	{"file": "report.spdx"},
+	{"file": "LICENSES/CC0-1.0.txt"}
+    ],
+
+    // Where this software/work initially comes from.
+    "upstream_url": "https://git.koszko.org/hydrilla-source-package-example",
+
+    // Additional "comment" field can be used if needed.
+    // "comment": ""
+
+    // List of actual site resources and pattern->payload mappings. Each of them
+    // is represented by an object. Meta-sites and replacement site interfaces
+    // will also belong here once they get implemented.
+    "definitions": [
+	{
+	    // Value of "type" can currently be one of: "resource" and
+	    // "mapping". The one we have here, "resource", defines a list
+	    // of injectable scripts that can be used as a payload or as a
+	    // dependency of another "resource". In the future CSS style sheets
+	    // and WASM modules will also be composite parts of a "resource" as
+	    // scripts are now.
+	    "type": "resource",
+
+	    // Used when referring to this resource in "dependencies" list of
+	    // another resource or in "payload" field of a mapping. Should
+	    // be consize and can only use a restricted set of characters. It
+	    // has to match: [-0-9a-z]+
+	    "identifier": "helloapple",
+
+	    // "long_name" should be used to specify a user-friendly alternative
+	    // to an identifier. It should generally not collide with a long
+	    // name of some resource with a different UUID and also shouldn't
+	    // change in-between versions of the same resource, although
+	    // exceptions to both rules might be considered. Long name is
+	    // allowed to contain arbitrary unicode characters (within reason!).
+	    "long_name": "Hello Apple",
+
+	    // Item definitions contain version information. Version is
+	    // represented as an array of integers, with major version number
+	    // being the first array item. In case of resources, version is
+	    // accompanied by a revision field which contains a positive
+	    // integer. If versions specified by arrays of different length need
+	    // to be compared, the shorter array gets padded with zeroes on the
+	    // right. This means that for example version 1.3 could be given as
+	    // both [1, 3] and [1, 3, 0, 0] (aka 1.3.0.0) and either would mean
+	    // the same.
+	    // Different versions (e.g. 1.0 and 1.3) of the same resource can be
+	    // defined in separate index.json files. This makes it easy to
+	    // accidently cause an identifier clash. To help detect it, we allow
+	    // each resource to have a UUID associated with it. Attempt to
+	    // define multiple resources with the same identifier and different
+	    // UUIDs will result in an error being reported. Defining multiple
+	    // resources with different identifiers and the same UUID is
+	    // disallowed for now (it may be later permitted if we consider it
+	    // good for some use-case).
+	    // As of package source schema version 1.0, UUIDs are optional and
+	    // can be omitted.
+	    "uuid": "a6754dcb-58d8-4b7a-a245-24fd7ad4cd68",
+
+	    // Version should match the upstream version of the resource (e.g. a
+	    // version of javascript library). Revision number starts as 1 for
+	    // each new resource version and gets incremented by 1 each time a
+	    // modification to the packaging of this version is done. Hydrilla
+	    // will allow multiple definitions of the same resource to load, as
+	    // long as their versions differ. Thanks to the "version" and
+	    // "revision" fields, clients will know they have to update certain
+	    // resource after it has been updated. If multiple definitions of
+	    // the same version of given resource are provided, an error is
+	    // generated (even if those definitions differ by revision number).
+	    "version": [2021, 11, 10],
+	    "revision": 1,
+
+	    // A short, meaningful description of what the resource is and/or
+	    // what it does.
+	    "description": "greets an apple",
+
+	    // If needed, a "comment" field can be added to provide some
+	    // additional information.
+	    // "comment": "this resource something something",
+
+	    // Resource's "dependencies" array shall contain names of other
+	    // resources that (in case of scripts at least) should get evaluated
+	    // on a page before this resource's own scripts.
+	    "dependencies": [{"identifier": "hello-message"}],
+
+	    // Array of javascript files that belong to this resource.
+	    "scripts": [
+		{"file": "hello.js"},
+		{"file":   "bye.js"}
+	    ]
+	}, {
+	    "type":	   "resource",
+	    "identifier":  "hello-message",
+	    "long_name":   "Hello Message",
+	    "uuid":	   "1ec36229-298c-4b35-8105-c4f2e1b9811e",
+	    "version":     [2021, 11, 10],
+	    "revision":    2,
+	    "description": "define messages for saying hello and bye",
+	    // If "dependencies" is empty, it can also be omitted.
+	    // "dependencies": [],
+	    "scripts": [{"file": "message.js"}]
+	}, {
+	    "type": "mapping",
+
+	    // Has similar function to resource's identifier. Should be consize
+	    // and can only use a restricted set of characters. It has to match:
+	    // [-0-9a-z]+
+	    // It can be the same as some resource identifier (those are
+	    // different entities and are treated separately).
+	    "identifier": "helloapple",
+
+	    // "long name" and "uuid" have the same meaning as in the case of
+	    // resources and "uuid" is also optional. UUIDs of a resource and a
+	    // mapping can technically be the same but it is recommended to
+	    // avoid even this kind of repetition.
+	    "long_name": "Hello Apple",
+	    "uuid": "54d23bba-472e-42f5-9194-eaa24c0e3ee7",
+
+	    // "version" differs from its counterpart in resource in that it has
+	    // no accompanying revision number.
+	    "version": [2021, 11, 10],
+
+	    // A short, meaningful description of what the mapping does.
+	    "description": "causes apple to get greeted on Hydrillabugs issue tracker",
+
+	    // A comment, if necessary.
+	    // "comment": "blah blah because bleh"
+
+	    // The "payloads" object specifies which payloads are to be applied
+	    // to which URLs.
+	    "payloads": {
+		// Each key should be a valid Haketilo URL pattern.
+		"https://hydrillabugs.koszko.org/***": {
+		    // Should be the name of an existing resource. The resource
+		    // may, but doesn't have to, be defined in the same
+		    // index.json file.
+		    "identifier": "helloapple"
+		},
+		// More associations may follow.
+		"https://hachettebugs.koszko.org/***": {
+		    "identifier": "helloapple"
+		}
+	    }
+	}
+    ],
+    // We can also list additional files to include in the produced source
+    // archive. Hydrilla builder will then include those together with all
+    // script and copyright files used.
+    "additional_files": [
+	{"file": "README.txt"},
+	{"file": "README.txt.license"},
+	{"file": ".reuse/dep5"}
+    ],
+    // We can optionally tell Hydrilla builder to run the REUSE tool to generate
+    // report.spdx file. Using this option requires REUSE to be installed and
+    // and importable in the Python virtualenv used by Hydrilla builder.
+    "reuse_generate_spdx_report": true
+}
diff --git a/tests/source-package-example/message.js b/tests/source-package-example/message.js
new file mode 100644
index 0000000..2ad61cb
--- /dev/null
+++ b/tests/source-package-example/message.js
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: CC0-1.0
+
+// Copyright (C) 2021 Wojtek Kosior <koszko@koszko.org>
+//
+// Available under the terms of Creative Commons Zero v1.0 Universal.
+
+var hello_message = "hello, "
+var bye_message = "bye, "
diff --git a/tests/test_hydrilla_builder.py b/tests/test_hydrilla_builder.py
new file mode 100644
index 0000000..851b5cd
--- /dev/null
+++ b/tests/test_hydrilla_builder.py
@@ -0,0 +1,472 @@
+# SPDX-License-Identifier: CC0-1.0
+
+# Copyright (C) 2022 Wojtek Kosior <koszko@koszko.org>
+#
+# Available under the terms of Creative Commons Zero v1.0 Universal.
+
+# Enable using with Python 3.7.
+from __future__ import annotations
+
+import pytest
+import json
+import shutil
+
+from tempfile import TemporaryDirectory
+from pathlib import Path
+from hashlib import sha256, sha1
+from zipfile import ZipFile
+from typing import Callable, Optional, Iterable
+
+from jsonschema import ValidationError
+
+from hydrilla import util as hydrilla_util
+from hydrilla.builder import build, _version
+
+here = Path(__file__).resolve().parent
+
+expected_generated_by = {
+    'name': 'hydrilla.builder',
+    'version': _version.version
+}
+
+default_srcdir = here / 'source-package-example'
+
+default_js_filenames = ['bye.js', 'hello.js', 'message.js']
+default_dist_filenames = [*default_js_filenames, 'LICENSES/CC0-1.0.txt']
+default_src_filenames = [
+    *default_dist_filenames,
+    'README.txt', 'README.txt.license', '.reuse/dep5', 'index.json'
+]
+
+default_sha1_hashes   = {}
+default_sha256_hashes = {}
+default_contents      = {}
+
+for fn in default_src_filenames:
+    with open(default_srcdir / fn, 'rb') as file_handle:
+        default_contents[fn]      = file_handle.read()
+        default_sha256_hashes[fn] = sha256(default_contents[fn]).digest().hex()
+        default_sha1_hashes[fn]   = sha1(default_contents[fn]).digest().hex()
+
+class CaseSettings:
+    """Gather parametrized values in a class."""
+    def __init__(self):
+        """Init CaseSettings with default values."""
+        self.srcdir = default_srcdir
+        self.index_json_path = Path('index.json')
+        self.report_spdx_included = True
+
+        self.js_filenames   = default_js_filenames.copy()
+        self.dist_filenames = default_dist_filenames.copy()
+        self.src_filenames  = default_src_filenames.copy()
+
+        self.sha1_hashes   = default_sha1_hashes.copy()
+        self.sha256_hashes = default_sha256_hashes.copy()
+        self.contents      = default_contents.copy()
+
+        self.expected_resources = [{
+            '$schema': 'https://hydrilla.koszko.org/schemas/api_resource_description-1.schema.json',
+            'source_name': 'hello',
+            'source_copyright': [{
+                'file': 'report.spdx',
+                'sha256': '!!!!value to fill during test!!!!'
+            }, {
+                'file': 'LICENSES/CC0-1.0.txt',
+                'sha256': self.sha256_hashes['LICENSES/CC0-1.0.txt']
+            }],
+            'type': 'resource',
+            'identifier': 'helloapple',
+            'long_name': 'Hello Apple',
+            'uuid': 'a6754dcb-58d8-4b7a-a245-24fd7ad4cd68',
+            'version': [2021, 11, 10],
+            'revision': 1,
+            'description': 'greets an apple',
+            'dependencies': [{'identifier': 'hello-message'}],
+            'scripts': [{
+                'file': 'hello.js',
+                'sha256': self.sha256_hashes['hello.js']
+            }, {
+                'file': 'bye.js',
+                'sha256': self.sha256_hashes['bye.js']
+            }],
+            'generated_by': expected_generated_by
+        }, {
+            '$schema': 'https://hydrilla.koszko.org/schemas/api_resource_description-1.schema.json',
+            'source_name': 'hello',
+            'source_copyright': [{
+                'file': 'report.spdx',
+                'sha256': '!!!!value to fill during test!!!!'
+            }, {
+                'file': 'LICENSES/CC0-1.0.txt',
+                'sha256': self.sha256_hashes['LICENSES/CC0-1.0.txt']
+            }],
+            'type': 'resource',
+            'identifier': 'hello-message',
+            'long_name': 'Hello Message',
+            'uuid': '1ec36229-298c-4b35-8105-c4f2e1b9811e',
+            'version': [2021, 11, 10],
+            'revision': 2,
+            'description': 'define messages for saying hello and bye',
+            'dependencies': [],
+            'scripts': [{
+                'file': 'message.js',
+                'sha256': self.sha256_hashes['message.js']
+            }],
+            'generated_by': expected_generated_by
+        }]
+        self.expected_mapping = {
+            '$schema': 'https://hydrilla.koszko.org/schemas/api_mapping_description-1.schema.json',
+            'source_name': 'hello',
+            'source_copyright': [{
+                'file': 'report.spdx',
+                'sha256': '!!!!value to fill during test!!!!'
+            }, {
+                'file': 'LICENSES/CC0-1.0.txt',
+                'sha256': self.sha256_hashes['LICENSES/CC0-1.0.txt']
+            }],
+            'type': 'mapping',
+	    'identifier': 'helloapple',
+	    'long_name': 'Hello Apple',
+	    'uuid': '54d23bba-472e-42f5-9194-eaa24c0e3ee7',
+	    'version': [2021, 11, 10],
+	    'description': 'causes apple to get greeted on Hydrillabugs issue tracker',
+	    'payloads': {
+	        'https://hydrillabugs.koszko.org/***': {
+		    'identifier': 'helloapple'
+	        },
+	        'https://hachettebugs.koszko.org/***': {
+		    'identifier': 'helloapple'
+                }
+            },
+            'generated_by': expected_generated_by
+        }
+        self.expected_source_description = {
+            '$schema': 'https://hydrilla.koszko.org/schemas/api_source_description-1.schema.json',
+            'source_name': 'hello',
+            'source_copyright': [{
+                'file': 'report.spdx',
+                'sha256': '!!!!value to fill during test!!!!'
+            }, {
+                'file': 'LICENSES/CC0-1.0.txt',
+                'sha256': self.sha256_hashes['LICENSES/CC0-1.0.txt']
+            }],
+            'source_archives': {
+                'zip': {
+                    'sha256': '!!!!value to fill during test!!!!',
+                }
+            },
+            'upstream_url': 'https://git.koszko.org/hydrilla-source-package-example',
+            'definitions': [{
+                'type': 'resource',
+                'identifier': 'helloapple',
+                'long_name': 'Hello Apple',
+                'version': [2021, 11, 10],
+            }, {
+                'type':       'resource',
+                'identifier': 'hello-message',
+                'long_name': 'Hello Message',
+                'version':     [2021, 11, 10],
+            }, {
+                'type': 'mapping',
+                'identifier': 'helloapple',
+	        'long_name': 'Hello Apple',
+                'version': [2021, 11, 10],
+            }],
+            'generated_by': expected_generated_by
+        }
+
+    def expected(self) -> list[dict]:
+        """
+        Convenience method to get a list of expected jsons of 2 resources,
+        1 mapping and 1 source description we have.
+        """
+        return [
+            *self.expected_resources,
+            self.expected_mapping,
+            self.expected_source_description
+        ]
+
+ModifyCb = Callable[[CaseSettings, dict], Optional[str]]
+
+def prepare_modified(tmpdir: Path, modify_cb: ModifyCb) -> CaseSettings:
+    """
+    Use sample source package directory with an alternative, modified
+    index.json.
+    """
+    settings = CaseSettings()
+
+    for fn in settings.src_filenames:
+        copy_path = tmpdir / 'srcdir_copy' / fn
+        copy_path.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy(settings.srcdir / fn, copy_path)
+
+    settings.srcdir = tmpdir / 'srcdir_copy'
+
+    with open(settings.srcdir / 'index.json', 'rt') as file_handle:
+        obj = json.loads(hydrilla_util.strip_json_comments(file_handle.read()))
+
+    contents = modify_cb(settings, obj)
+
+    # Replace the other index.json with new one
+    settings.index_json_path = tmpdir / 'replacement.json'
+
+    if contents is None:
+        contents = json.dumps(obj)
+
+    contents = contents.encode()
+
+    settings.contents['index.json'] = contents
+
+    settings.sha256_hashes['index.json'] = sha256(contents).digest().hex()
+    settings.sha1_hashes['index.json']   = sha1(contents).digest().hex()
+
+    with open(settings.index_json_path, 'wb') as file_handle:
+        file_handle.write(contents)
+
+    return settings
+
+@pytest.fixture()
+def tmpdir() -> Iterable[str]:
+    with TemporaryDirectory() as tmpdir:
+        yield tmpdir
+
+def prepare_default(tmpdir: Path) -> CaseSettings:
+    """Use sample source package directory as exists in VCS."""
+    return CaseSettings()
+
+def modify_index_good(settings: CaseSettings, obj: dict) -> None:
+    """
+    Modify index.json object to make a slightly different but *also correct* one
+    that can be used to test some different cases.
+    """
+    # Add comments that should be preserved.
+    for dictionary in (obj, settings.expected_source_description):
+        dictionary['comment'] = 'index_json comment'
+
+    for i, dicts in enumerate(zip(obj['definitions'], settings.expected())):
+        for dictionary in dicts:
+            dictionary['comment'] = f'item {i}'
+
+    # Remove spdx report generation
+    del obj['reuse_generate_spdx_report']
+    obj['copyright'].remove({'file': 'report.spdx'})
+
+    settings.report_spdx_included = False
+
+    for json_description in settings.expected():
+        json_description['source_copyright'] = \
+            [fr for fr in json_description['source_copyright']
+             if fr['file'] != 'report.spdx']
+
+    # Use default value ([]) for 'additionall_files' property
+    del obj['additional_files']
+
+    settings.src_filenames = [*settings.dist_filenames, 'index.json']
+
+    # Use default value ([]) for 'scripts' property in one of the resources
+    del obj['definitions'][1]['scripts']
+
+    settings.expected_resources[1]['scripts'] = []
+
+    for prefix in ('js', 'dist', 'src'):
+        getattr(settings, f'{prefix}_filenames').remove('message.js')
+
+    # Use default value ({}) for 'pyloads' property in mapping
+    del obj['definitions'][2]['payloads']
+
+    settings.expected_mapping['payloads'] = {}
+
+    # Don't use UUIDs (they are optional)
+    for definition in obj['definitions']:
+        del definition['uuid']
+
+    for description in settings.expected():
+        if 'uuid' in description:
+            del description['uuid']
+
+    # Add some unrecognized properties that should be stripped
+    to_process = [obj]
+    while to_process:
+        processed = to_process.pop()
+
+        if type(processed) is list:
+            to_process.extend(processed)
+        elif type(processed) is dict and 'spurious_property' not in processed:
+            to_process.extend(processed.values())
+            processed['spurious_property'] = 'some value'
+
+@pytest.mark.parametrize('prepare_source_example', [
+    prepare_default,
+    lambda tmpdir: prepare_modified(tmpdir, modify_index_good)
+])
+def test_build(tmpdir, prepare_source_example):
+    """Build the sample source package and verify the produced files."""
+    # First, build the package
+    dstdir = Path(tmpdir) / 'dstdir'
+    tmpdir = Path(tmpdir) / 'example'
+
+    dstdir.mkdir(exist_ok=True)
+    tmpdir.mkdir(exist_ok=True)
+
+    settings = prepare_source_example(tmpdir)
+
+    build.Build(settings.srcdir, settings.index_json_path)\
+        .write_package_files(dstdir)
+
+    # Verify directories under destination directory
+    assert {'file', 'resource', 'mapping', 'source'} == \
+        set([path.name for path in dstdir.iterdir()])
+
+    # Verify files under 'file/'
+    file_dir = dstdir / 'file' / 'sha256'
+
+    for fn in settings.dist_filenames:
+        dist_file_path = file_dir / settings.sha256_hashes[fn]
+        assert dist_file_path.is_file()
+
+        assert dist_file_path.read_bytes() == settings.contents[fn]
+
+    sha256_hashes_set = set([settings.sha256_hashes[fn]
+                             for fn in settings.dist_filenames])
+
+    spdx_report_sha256 = None
+
+    for path in file_dir.iterdir():
+        if path.name in sha256_hashes_set:
+            continue
+
+        assert spdx_report_sha256 is None and settings.report_spdx_included
+
+        with open(path, 'rt') as file_handle:
+            spdx_contents = file_handle.read()
+
+        spdx_report_sha256 = sha256(spdx_contents.encode()).digest().hex()
+        assert spdx_report_sha256 == path.name
+
+        for fn in settings.src_filenames:
+            if not any([n in fn.lower() for n in ('license', 'reuse')]):
+                assert settings.sha1_hashes[fn]
+
+    if settings.report_spdx_included:
+        assert spdx_report_sha256
+        for obj in settings.expected():
+            for file_ref in obj['source_copyright']:
+                if file_ref['file'] == 'report.spdx':
+                    file_ref['sha256'] = spdx_report_sha256
+
+    # Verify files under 'resource/'
+    resource_dir = dstdir / 'resource'
+
+    assert set([rj['identifier'] for rj in settings.expected_resources]) == \
+        set([path.name for path in resource_dir.iterdir()])
+
+    for resource_json in settings.expected_resources:
+        subdir = resource_dir / resource_json['identifier']
+        assert ['2021.11.10'] == [path.name for path in subdir.iterdir()]
+
+        with open(subdir / '2021.11.10', 'rt') as file_handle:
+            assert json.load(file_handle) == resource_json
+
+        hydrilla_util.validator_for('api_resource_description-1.0.1.schema.json')\
+                     .validate(resource_json)
+
+    # Verify files under 'mapping/'
+    mapping_dir = dstdir / 'mapping'
+    assert ['helloapple'] == [path.name for path in mapping_dir.iterdir()]
+
+    subdir = mapping_dir / 'helloapple'
+    assert ['2021.11.10'] == [path.name for path in subdir.iterdir()]
+
+    with open(subdir / '2021.11.10', 'rt') as file_handle:
+        assert json.load(file_handle) == settings.expected_mapping
+
+    hydrilla_util.validator_for('api_mapping_description-1.0.1.schema.json')\
+                 .validate(settings.expected_mapping)
+
+    # Verify files under 'source/'
+    source_dir = dstdir / 'source'
+    assert {'hello.json', 'hello.zip'} == \
+        set([path.name for path in source_dir.iterdir()])
+
+    zip_filenames = [f'hello/{fn}' for fn in settings.src_filenames]
+
+    with ZipFile(source_dir / 'hello.zip', 'r') as archive:
+        assert set([f.filename for f in archive.filelist]) == set(zip_filenames)
+
+        for zip_fn, src_fn in zip(zip_filenames, settings.src_filenames):
+            with archive.open(zip_fn, 'r') as zip_file_handle:
+                assert zip_file_handle.read() == settings.contents[src_fn]
+
+    zip_ref = settings.expected_source_description['source_archives']['zip']
+    with open(source_dir / 'hello.zip', 'rb') as file_handle:
+        zip_ref['sha256'] = sha256(file_handle.read()).digest().hex()
+
+    with open(source_dir / 'hello.json', 'rt') as file_handle:
+        assert json.load(file_handle) == settings.expected_source_description
+
+    hydrilla_util.validator_for('api_source_description-1.0.1.schema.json')\
+                 .validate(settings.expected_source_description)
+
+def modify_index_missing_file(dummy: CaseSettings, obj: dict) -> None:
+    """
+    Modify index.json to expect missing report.spdx file and cause an error.
+    """
+    del obj['reuse_generate_spdx_report']
+
+def modify_index_schema_error(dummy: CaseSettings, obj: dict) -> None:
+    """Modify index.json to be incompliant with the schema."""
+    del obj['definitions']
+
+def modify_index_bad_comment(dummy: CaseSettings, obj: dict) -> str:
+    """Modify index.json to have an invalid '/' in it."""
+    return json.dumps(obj) + '/something\n'
+
+def modify_index_bad_json(dummy: CaseSettings, obj: dict) -> str:
+    """Modify index.json to not be valid json even after comment stripping."""
+    return json.dumps(obj) + '???/\n'
+
+def modify_index_missing_license(settings: CaseSettings, obj: dict) -> None:
+    """Remove a file to make package REUSE-incompliant."""
+    (settings.srcdir / 'README.txt.license').unlink()
+
+def modify_index_file_outside(dummy: CaseSettings, obj: dict) -> None:
+    """Make index.json illegally reference a file outside srcdir."""
+    obj['copyright'].append({'file': '../abc'})
+
+def modify_index_reference_itself(dummy: CaseSettings, obj: dict) -> None:
+    """Make index.json illegally reference index.json."""
+    obj['copyright'].append({'file': 'index.json'})
+
+def modify_index_report_excluded(dummy: CaseSettings, obj: dict) -> None:
+    """
+    Make index.json require generation of index.json but not include it among
+    copyright files.
+    """
+    obj['copyright'] = [fr for fr in obj['copyright']
+                        if fr['file'] != 'report.spdx']
+
+@pytest.mark.parametrize('break_index_json', [
+    (modify_index_missing_file,     FileNotFoundError),
+    (modify_index_schema_error,     ValidationError),
+    (modify_index_bad_comment,      json.JSONDecodeError),
+    (modify_index_bad_json,         json.JSONDecodeError),
+    (modify_index_missing_license,  build.ReuseError),
+    (modify_index_file_outside,     build.FileReferenceError),
+    (modify_index_reference_itself, build.FileReferenceError),
+    (modify_index_report_excluded,  build.FileReferenceError)
+])
+def test_build_error(tmpdir: str, break_index_json: tuple[ModifyCb, type]):
+    """Build the sample source package and verify the produced files."""
+    dstdir = Path(tmpdir) / 'dstdir'
+    tmpdir = Path(tmpdir) / 'example'
+
+    dstdir.mkdir(exist_ok=True)
+    tmpdir.mkdir(exist_ok=True)
+
+    modify_cb, error_type = break_index_json
+
+    settings = prepare_modified(tmpdir, modify_cb)
+
+    with pytest.raises(error_type):
+        build.Build(settings.srcdir, settings.index_json_path)\
+            .write_package_files(dstdir)