#!/usr/bin/env python3
"""Read-only manifest/artifact/STARK verification. Does not identify a publisher or assert a chain seal.
Run with --manifest manifest.json --artifacts-dir . --receipt receipt.bin --verifier ./risc0-receipt-verify.exe
"""
import argparse,hashlib,json,pathlib,subprocess,re,sys
ROOT="60160174bf3622894d4cec9514cc08cf9e874779725cdfd6b2649d954c0599d8"
IMAGE="61d34eaa3bf6b86840a1bbf7806cb46192281a2b333ef0f57a5517b00cd669e4"
BIN_SHA256="d6d6afb7438227476b2f5e206d7100a10d6767ec1bba0051e8e48503a4fdbed5"
RECEIPT_SHA256="2efc1acaf4cb234fa5e9273753fda1bb9e2daeff7fea1b5aa9777c591ef98001"
def sha(b):return hashlib.sha256(b).hexdigest()
def read(p):
 p=pathlib.Path(p)
 if p.is_symlink() or not p.is_file():raise ValueError('missing file or symlink')
 return p.read_bytes()
def main():
 ap=argparse.ArgumentParser();ap.add_argument('--manifest',default='manifest.json');ap.add_argument('--artifacts-dir');ap.add_argument('--receipt');ap.add_argument('--verifier');a=ap.parse_args()
 try:
  raw=read(a.manifest)
  if sha(raw)!=ROOT:raise ValueError('manifest hash mismatch')
  obj=json.loads(raw)
  if sorted(x['name'] for x in obj['visible_artifacts'])!=['inner-research.mp4','n4k8.pdf','title.mp4']:raise ValueError('artifact list mismatch')
  print('manifest: VERIFIED')
  if a.artifacts_dir:
   for x in obj['visible_artifacts']:
    b=read(pathlib.Path(a.artifacts_dir)/x['name'])
    if len(b)!=x['bytes'] or sha(b)!=x['sha256']:raise ValueError('original file mismatch: '+x['name'])
   print('original files: VERIFIED')
  else:print('original files: NOT CHECKED')
  if a.receipt and a.verifier:
   if sha(read(a.verifier))!=BIN_SHA256 or sha(read(a.receipt))!=RECEIPT_SHA256:raise ValueError('verifier/receipt checksum mismatch')
   z=subprocess.run([str(pathlib.Path(a.verifier).resolve()),'verify-file',str(pathlib.Path(a.receipt).resolve()),ROOT],capture_output=True,text=True,timeout=90)
   out=z.stdout+'\n'+z.stderr
   if z.returncode!=0 or not re.search(r'(?im)^verify:\s*OK\s*$',out) or not re.search(r'(?im)^image_id:\s*'+IMAGE+r'\s*$',out) or not re.search(r'(?im)^journal_match:\s*true\s*$',out):raise ValueError('STARK verifier failed or expected image/journal missing')
   print('RISC Zero proof: VERIFIED')
  else:print('RISC Zero proof: NOT CHECKED')
  print('Stellar anchor: NOT CHECKED by this script; original release remains UNSEALED until independent mainnet check')
  return 0 if a.artifacts_dir and a.receipt and a.verifier else 2
 except Exception as exc:print('FAILED:',str(exc),file=sys.stderr);return 1
if __name__=='__main__':sys.exit(main())