#!/usr/bin/env python3
"""Create or verify SHA-256 manifests for evidence integrity checks."""

from __future__ import annotations

import argparse
import hashlib
from pathlib import Path


def sha256(path: Path) -> str:
    digest = hashlib.sha256()
    with path.open("rb") as handle:
        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
            digest.update(chunk)
    return digest.hexdigest()


def write_manifest(paths: list[Path], manifest: Path) -> None:
    with manifest.open("w", encoding="utf-8") as handle:
        for path in paths:
            handle.write(f"{sha256(path)}  {path}\n")


def verify_manifest(manifest: Path) -> bool:
    ok = True
    for line in manifest.read_text(encoding="utf-8").splitlines():
        if not line.strip():
            continue
        expected, filename = line.split(maxsplit=1)
        filename = filename.strip()
        actual = sha256(Path(filename))
        if actual.lower() == expected.lower():
            print(f"OK  {filename}")
        else:
            ok = False
            print(f"FAIL {filename}: expected {expected}, got {actual}")
    return ok


def main() -> int:
    parser = argparse.ArgumentParser(description="Generate or verify evidence hash manifests.")
    sub = parser.add_subparsers(dest="cmd", required=True)
    create = sub.add_parser("create")
    create.add_argument("files", nargs="+", type=Path)
    create.add_argument("--manifest", type=Path, default=Path("SHA256SUMS"))
    verify = sub.add_parser("verify")
    verify.add_argument("manifest", type=Path)
    args = parser.parse_args()
    if args.cmd == "create":
        write_manifest(args.files, args.manifest)
        print(f"Wrote manifest to {args.manifest}")
        return 0
    return 0 if verify_manifest(args.manifest) else 1


if __name__ == "__main__":
    raise SystemExit(main())