#!/usr/bin/env python3
import argparse,base64,hashlib,json
from pathlib import Path
from ed25519_pure import verify as V
R=Path(__file__).resolve().parent;C=lambda o:json.dumps(o,sort_keys=True,separators=(",",":"),ensure_ascii=False).encode();H=lambda b:hashlib.sha256(b).hexdigest()
def check(t=False):
 m=json.loads((R/"capsule/signed_confirmation_manifest.json").read_text());sp=m["signed_payload"];pub=base64.b64decode(m["public_key"]);e=[]
 if not V(base64.b64decode(m["signature"]),C(sp),pub):e.append("manifest_signature")
 for rel,x in sp["artifacts"].items():
  p=R/rel
  if not p.exists() or H(p.read_bytes())!=x:e.append("artifact:"+rel)
 recs=[json.loads((R/p).read_text()) for p in sp["receipt_paths"]]
 if t and len(recs)>2:recs[len(recs)//2]["signed_payload"]["public_description"]+=" [TAMPERED]"
 prev=None
 for i,r in enumerate(recs):
  if r["sequence"]!=i or r["prev_hash"]!=prev:e.append(f"chain:{i}")
  x=dict(r);got=x.pop("entry_hash",None)
  if H(C(x))!=got:e.append(f"entry_hash:{i}")
  if not V(base64.b64decode(r["signature"]),C(r["signed_payload"]),pub):e.append(f"leaf_signature:{i}")
  prev=got
 if prev!=sp["confirmation_head"]:e.append("confirmation_head")
 ok=not e;print(json.dumps({"valid":ok,"tamper_mode":t,"receipt_count":len(recs),"signer_fingerprint":H(pub),"confirmation_head":sp["confirmation_head"],"errors":e},sort_keys=True));return ok
if __name__=="__main__":
 a=argparse.ArgumentParser();a.add_argument("--tamper",action="store_true");x=a.parse_args();ok=check(x.tamper);raise SystemExit(0 if (ok and not x.tamper) or ((not ok) and x.tamper) else 1)
