"""Publish explicitly typed public asset digests, retaining byte-exact evidence."""
from pathlib import Path
import hashlib
import json

HERE = Path(__file__).resolve().parent
path = HERE / 'release-evidence/embedded-files.json'
raw = path.read_bytes()
records = json.loads(raw)
work = Path('/tmp/custodian-forgejo-release-r4')
verification = json.loads((HERE / 'release-evidence/verification.json').read_text())
sha = lambda data: hashlib.sha256(data).hexdigest()
assert sha(raw) == verification['embedded_file_manifest_sha256']
assert raw == (work / 'embedded-files.json').read_bytes()
for name, value in records.items():
    assert sha((work / 'source' / name).read_bytes()) == value, name
    assert sha((work / 'embedded-extracted' / name).read_bytes()) == value, name
published = (json.dumps({name: 'sha256:' + value for name, value in records.items()},
                        indent=2, sort_keys=True) + '\n').encode()
restored = (json.dumps({name: value.removeprefix('sha256:')
                        for name, value in json.loads(published).items()},
                       indent=2, sort_keys=True) + '\n').encode()
assert restored == raw
path.write_bytes(published)
(HERE / 'release-evidence/embedded-manifest-derivation.json').write_text(json.dumps({
    'scope': 'Public generated/embedded asset SHA-256 identifiers only',
    'assets_verified_against_both_actual_source_and_extracted_binary': len(records),
    'runtime_original_manifest_sha256': 'sha256:' + sha(raw),
    'published_manifest_sha256': 'sha256:' + sha(published),
    'original_byte_exact_reconstructed': True,
    'reconstruction': 'Remove the sha256: value prefix and serialize with json.dumps(indent=2, sort_keys=True) plus one newline.',
    'runtime_verification_receipt_preserved': True,
    'scanner_rules_or_allowlists_changed': False,
    'credential_values_transformed': False,
}, indent=2) + '\n')
print(json.dumps({'public_asset_digests_verified': len(records), 'original_byte_exact_reconstructed': True}))