"""Read-only integrity verification of this evidence archive; runs no product code."""
import datetime
import hashlib
import json
import pathlib
import stat
import zipfile

ROOT = pathlib.Path(__file__).resolve().parent

def sha(raw):
    return hashlib.sha256(raw).hexdigest()

def safe_name(name):
    parts = name.split("/")
    assert name and not pathlib.PurePosixPath(name).is_absolute()
    assert "\\" not in name and ":" not in name
    assert all(part not in ("", ".", "..") for part in parts)

def ordinary(path):
    assert path.is_file() and not path.is_symlink(), str(path)
    assert not (getattr(path.stat(), "st_file_attributes", 0) & 0x400), str(path)

def verify():
    manifest_raw = (ROOT / "manifest.json").read_bytes()
    manifest = json.loads(manifest_raw)
    expected = {row["path"]: row for row in manifest["payloads"]}
    assert len(expected) == len(manifest["payloads"])
    actual = set()
    for path in ROOT.rglob("*"):
        assert not path.is_symlink()
        assert not (getattr(path.stat(), "st_file_attributes", 0) & 0x400)
        if path.is_file():
            actual.add(path.relative_to(ROOT).as_posix())
        else:
            assert path.is_dir()
    allowed = set(expected) | {"manifest.json"}
    if (ROOT / "readback.json").exists():
        allowed.add("readback.json")
    assert actual == allowed, {"extra": sorted(actual - allowed), "missing": sorted(allowed - actual)}
    payload_bytes = 0
    for name, row in expected.items():
        safe_name(name)
        path = ROOT / name
        ordinary(path)
        raw = path.read_bytes()
        assert len(raw) == row["bytes"] and sha(raw) == row["sha256"], name
        payload_bytes += len(raw)
    snapshots = []
    for label in ("inputs1", "inputs2"):
        captured = json.loads((ROOT / (label + ".json")).read_text(encoding="utf-8"))
        records = {row["path"]: row for row in captured["files"]}
        assert len(records) == len(captured["files"])
        archive = ROOT / (label + ".zip")
        assert sha(archive.read_bytes()) == captured["archiveSha256"]
        with zipfile.ZipFile(archive) as z:
            infos = z.infolist()
            assert len(infos) == len(records) and set(z.namelist()) == set(records)
            folded = set()
            for info in infos:
                name = info.filename
                safe_name(name)
                assert not info.is_dir() and not (info.flag_bits & 1)
                assert not stat.S_ISLNK(info.external_attr >> 16)
                assert name.lower() not in folded
                folded.add(name.lower())
                raw = z.read(info)
                assert len(raw) == records[name]["bytes"] and sha(raw) == records[name]["sha256"], name
        historical = json.loads((ROOT / (label + "-readback.json")).read_text(encoding="utf-8"))
        assert historical["passed"] and all(not historical[k] for k in ("changed", "added", "removed"))
        snapshots.append({"label": label, "members": len(records), "source_bytes": sum(r["bytes"] for r in records.values()), "zip_sha256": captured["archiveSha256"], "safe_exact_member_readback": True})
    result = {"verified_at_utc": datetime.datetime.now(datetime.timezone.utc).isoformat(), "passed": True, "manifest_sha256": sha(manifest_raw), "payload_files": len(expected), "payload_bytes": payload_bytes, "source_copies": sum(row["provenance"] == "exact original bytes" for row in expected.values()), "exact_file_set": True, "snapshots": snapshots}
    receipt = ROOT / "readback.json"
    if receipt.exists():
        prior = json.loads(receipt.read_text(encoding="utf-8"))
        assert prior["passed"] and prior["manifest_sha256"] == result["manifest_sha256"]
        for key in ("payload_files", "payload_bytes", "source_copies", "exact_file_set", "snapshots"):
            assert prior[key] == result[key], key
    return result

if __name__ == "__main__":
    print(json.dumps(verify(), indent=2, ensure_ascii=False))