#!/usr/bin/env python3
"""Verify exact vendored producer bytes and optionally a prospective upstream.

Updates require reviewed replacement of API/sign files, fixture refresh from the
producer, and reviewed manifest hashes/revision; this checker never updates them.
"""
import argparse
import hashlib
import json
from pathlib import Path

parser=argparse.ArgumentParser()
parser.add_argument('--upstream',type=Path)
args=parser.parse_args()
root=Path(__file__).resolve().parents[1]
manifest=json.loads((root/'verifier/producer-source.json').read_text())
for name,digest in manifest['files'].items():
    assert hashlib.sha256((root/'verifier'/name).read_bytes()).hexdigest()==digest, name
    if args.upstream:
        assert hashlib.sha256((args.upstream/name).read_bytes()).hexdigest()==digest, 'upstream drift: '+name
for name,digest in manifest['fixtures'].items():
    assert hashlib.sha256((root/'tests/fixtures/pdp-signature'/name).read_bytes()).hexdigest()==digest, name
print('producer source and fixture hashes match the admitted source snapshot')