#!/usr/bin/env python3
"""Verify an EcoKure EvidencePack without importing the EcoKure application.

Usage: python verify_evidence_pack.py path/to/pack.json
Requires the standard `cryptography` package only for Ed25519 signatures.
"""
from __future__ import annotations
import base64, hashlib, json, sys

def canonical(value):
    return json.dumps(value, sort_keys=True, separators=(",", ":"))

def verify(pack):
    records = pack.get("records") or []
    if not records:
        raise ValueError("no signed records found")
    previous = "0" * 64
    for expected_sequence, record in enumerate(records, 1):
        if record.get("sequence") != expected_sequence:
            raise ValueError(f"sequence mismatch at record {expected_sequence}")
        if record.get("prev_hash") != previous:
            raise ValueError(f"previous hash mismatch at record {expected_sequence}")
        expected_hash = hashlib.sha256((previous + canonical(record["payload"])).encode()).hexdigest()
        if record.get("entry_hash") != expected_hash:
            raise ValueError(f"entry hash mismatch at record {expected_sequence}")
        previous = expected_hash
    if pack.get("chain_root") != records[0]["entry_hash"] or pack.get("chain_tip") != records[-1]["entry_hash"]:
        raise ValueError("chain root or tip does not match records")
    try:
        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
        public_key = Ed25519PublicKey.from_public_bytes(base64.b64decode(pack["public_key_base64"], validate=True))
        for record in records:
            public_key.verify(base64.b64decode(record["signature"], validate=True), record["entry_hash"].encode())
        signatures = True
    except ImportError:
        signatures = "not checked (install cryptography)"
    return {"ok": True, "records": len(records), "chain_tip": previous, "signatures": signatures,
            "replay": "Replay only the payload-defined affected set; route unknown provenance to human review."}

def main():
    if len(sys.argv) != 2:
        raise SystemExit("usage: python verify_evidence_pack.py path/to/pack.json")
    with open(sys.argv[1], encoding="utf-8") as handle:
        result = verify(json.load(handle))
    print(json.dumps(result, indent=2))

if __name__ == "__main__":
    main()