#!/usr/bin/env python
"""Check this log without trusting whoever published it. Standard library only.

    python verify.py            # in the directory holding head.json

It rebuilds the RFC 6962 Merkle root from the published leaf hashes and compares it with the root in
head.json, then re-derives sth_hash from the head's own fields. A published root that does not follow
from the published leaves is what this catches, and it is exactly what an operator rewriting history
would have to change.

THE HASHING IS RFC 6962 AND THE DETAILS MATTER. Leaves are SHA-256(0x00 || data) and nodes are
SHA-256(0x01 || left || right), and the tree splits at the largest power of two STRICTLY below n, not
into pairs. The first draft of this file used pairwise levels and a plain SHA-256 leaf, which agrees
with the real tree only when the entry count is a power of two: it would have reported FAILED on an
honest log of three entries, under a heading that invites you to distrust us.

What it does NOT check: the signature on the head, which needs an Ed25519 implementation, and whether
any entry is TRUE. A log proves what was recorded, never that it is right.
"""
import hashlib, json, os


def node_hash(left, right):
    return hashlib.sha256(b"
" + left + right).digest()


def split_at(n):
    """The largest power of two strictly less than n. RFC 6962 splits the tree there."""
    k = 1
    while k << 1 < n:
        k <<= 1
    return k


def root_of(mtl):
    if not mtl:
        return hashlib.sha256(b"").digest()
    if len(mtl) == 1:
        return mtl[0]
    k = split_at(len(mtl))
    return node_hash(root_of(mtl[:k]), root_of(mtl[k:]))


def sth_hash_of(head):
    """SHA-256 over the canonical JSON of the four fields the head commits to."""
    fields = ("n_writes", "writes_tip", "n_tombstones", "tombstones_tip")
    body = json.dumps({k: head.get(k) for k in fields},
                      sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
    return hashlib.sha256(body).hexdigest()


def main():
    head = json.load(open("head.json", encoding="utf-8"))
    rows = []
    with open("log.jsonl", encoding="utf-8") as fh:
        for line in fh:
            line = line.strip()
            if line:
                rows.append(json.loads(line))
    mtl = [bytes.fromhex(r["leaf_hash"]) for r in rows]

    problems = []
    # If the publisher shipped the payloads, check each one hashes to what the log recorded. This is
    # what makes the TEXT of an entry checkable rather than only its position in the tree.
    payloads, checked_payloads = None, 0
    if os.path.exists("payloads.json"):
        payloads = json.load(open("payloads.json", encoding="utf-8"))
        for row in rows:
            entry = row.get("entry") or {}
            subject, want = entry.get("subject"), entry.get("payload_sha256")
            if subject is None or want is None:
                continue
            if subject not in payloads:
                problems.append("payloads.json has nothing for " + subject)
                continue
            got_p = hashlib.sha256(payloads[subject].encode("utf-8")).hexdigest()
            if got_p != want:
                problems.append("the published text of %s does not hash to what the log recorded"
                                % subject)
            else:
                checked_payloads += 1
    if len(mtl) != head["n_writes"]:
        problems.append("head says %d entries, log.jsonl holds %d" % (head["n_writes"], len(mtl)))
    got = root_of(mtl).hex()
    if got != head["writes_tip"]:
        problems.append("the published root is not the root of the published leaves")
        problems.append("   published " + head["writes_tip"])
        problems.append("   rebuilt   " + got)
    if sth_hash_of(head) != head["sth_hash"]:
        problems.append("sth_hash does not follow from the head's own fields")

    if problems:
        print("FAILED")
        for p in problems:
            print(" -", p)
        return 1
    print("OK: %d entries, root %s" % (len(mtl), head["writes_tip"]))
    print("checked: the root follows from the leaves, and sth_hash follows from the head.")
    if payloads is not None:
        print("checked: %d published entry texts hash to what the log recorded." % checked_payloads)
    print("NOT checked: the signature on the head, and whether any entry is true.")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())