#!/usr/bin/env python3
"""
Simple verifier for mirror-thin-v1 artefacts.
Checks:
1) SHA256 of manifest and tarball matches provided .sha256 files.
2) Manifest schema has required fields.
3) Tarball contains manifest.json, layers/, indexes/ with deterministic tar headers (mtime=0, uid/gid=0, sorted paths).
4) Tar content digests match manifest entries.

Usage:
  python scripts/mirror/verify_thin_bundle.py out/mirror/thin/mirror-thin-v1.manifest.json out/mirror/thin/mirror-thin-v1.tar.gz

Exit code 0 on success; non-zero on any check failure.
"""
import json, tarfile, hashlib, sys, pathlib

REQUIRED_FIELDS = ["version", "created", "layers", "indexes"]

def sha256_file(path: pathlib.Path) -> str:
    h = hashlib.sha256()
    with path.open("rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            h.update(chunk)
    return h.hexdigest()

def load_sha256_sidecar(path: pathlib.Path) -> str:
    sidecar = path.with_suffix(path.suffix + ".sha256")
    if not sidecar.exists():
        raise SystemExit(f"missing sidecar {sidecar}")
    return sidecar.read_text().strip().split()[0]

def check_schema(manifest: dict):
    missing = [f for f in REQUIRED_FIELDS if f not in manifest]
    if missing:
        raise SystemExit(f"manifest missing fields: {missing}")

def normalize(name: str) -> str:
    return name[2:] if name.startswith("./") else name

def check_tar_determinism(tar_path: pathlib.Path):
    with tarfile.open(tar_path, "r:gz") as tf:
        names = [normalize(n) for n in tf.getnames()]
        if names != sorted(names):
            raise SystemExit("tar entries not sorted")
        for m in tf.getmembers():
            if m.uid != 0 or m.gid != 0:
                raise SystemExit(f"tar header uid/gid not zero for {m.name}")
            if m.mtime != 0:
                raise SystemExit(f"tar header mtime not zero for {m.name}")

def check_content_hashes(manifest: dict, tar_path: pathlib.Path):
    with tarfile.open(tar_path, "r:gz") as tf:
        def get(name: str):
            try:
                return tf.getmember(name)
            except KeyError:
                # retry with leading ./
                return tf.getmember(f"./{name}")
        for layer in manifest.get("layers", []):
            name = layer["path"]
            info = get(name)
            data = tf.extractfile(info).read()
            digest = hashlib.sha256(data).hexdigest()
            if layer["digest"] != f"sha256:{digest}":
                raise SystemExit(f"layer digest mismatch {name}: {digest}")
        for idx in manifest.get("indexes", []):
            name = idx['name']
            if not name.startswith("indexes/"):
                name = f"indexes/{name}"
            info = get(name)
            data = tf.extractfile(info).read()
            digest = hashlib.sha256(data).hexdigest()
            if idx["digest"] != f"sha256:{digest}":
                raise SystemExit(f"index digest mismatch {name}: {digest}")


def main():
    if len(sys.argv) != 3:
        print(__doc__)
        sys.exit(2)
    manifest_path = pathlib.Path(sys.argv[1])
    tar_path = pathlib.Path(sys.argv[2])

    man_expected = load_sha256_sidecar(manifest_path)
    tar_expected = load_sha256_sidecar(tar_path)
    if sha256_file(manifest_path) != man_expected:
        raise SystemExit("manifest sha256 mismatch")
    if sha256_file(tar_path) != tar_expected:
        raise SystemExit("tarball sha256 mismatch")

    manifest = json.loads(manifest_path.read_text())
    check_schema(manifest)
    check_tar_determinism(tar_path)
    check_content_hashes(manifest, tar_path)
    print("OK: mirror-thin bundle verified")

if __name__ == "__main__":
    main()