git() { if [ "$1" = rev-parse ]; then echo "$TEST_SHA"; fi; }
tar() { cat >/dev/null; }
node() { echo "verify $*" >> "$TEST_DIR/calls"; }
docker() {
 echo "docker $*" >> "$TEST_DIR/calls"
 if [ "$1" = login ]; then cat >/dev/null; return; fi
 if [ "$1 $2" = "image inspect" ]; then
  if [[ "$*" = *org.opencontainers.image.revision* ]]; then echo "$TEST_SHA"
  elif [[ "${@: -1}" = *verified-* ]]; then
   case "$SCENARIO" in verified) echo sha256:candidate ;; mismatch) echo sha256:other ;; *) return 1 ;; esac
  else echo sha256:candidate; fi
 fi
}
export -f git tar node docker

curl() {
 local output="${@: -1}"
 cat > "$output" <<'MOCK'
#!/usr/bin/env bash
echo "regctl $*" >> "$TEST_DIR/calls"
if [[ "$1 $2" = "image copy" && "$SCENARIO" = upload-fails ]]; then exit 1; fi
if [[ "$1 $2" = "manifest get" ]]; then
 if [[ "$SCENARIO" = wrong-config && "$3" != ocidir:* ]]; then echo sha256:wrong; else printf "sha256:%064d\n" 0; fi
fi
MOCK
}
sha256sum() { cat >/dev/null; [[ "$SCENARIO" != bad-checksum ]]; }
uname() { echo x86_64; }
export -f curl sha256sum uname