#!/usr/bin/env python3
"""Diagnostyka podpisów w repo: pojedynczo npth + skan całości."""
import os, json, subprocess, hashlib, concurrent.futures

BASE = "/var/www/repo.paganlinux.eu/stable"


def sh(cmd):
    r = subprocess.run(cmd, capture_output=True, text=True)
    return r.returncode, (r.stdout or ""), (r.stderr or "")


print("=== npth: pliki ===")
for f in sorted(os.listdir(BASE)):
    if f.startswith("npth"):
        fp = os.path.join(BASE, f)
        st = os.stat(fp)
        print(f"  {f}  {st.st_size} B  mtime={int(st.st_mtime)}")
print("=== npth: gpg --verify ===")
rc, out, err = sh(["gpg", "--verify", os.path.join(BASE, "npth-1.8-1.pag.asc"),
                   os.path.join(BASE, "npth-1.8-1.pag")])
print("rc:", rc)
print((err or out).strip()[:500])
print("=== npth: sha256 pliku vs repo.json ===")
h = hashlib.sha256(open(os.path.join(BASE, "npth-1.8-1.pag"), "rb").read()).hexdigest()
d = json.load(open(os.path.join(BASE, "repo.json")))
e = [p for p in d["packages"] if p["name"] == "npth"]
print("plik :", h)
print("json :", e[0]["sha256"] if e else "brak wpisu", "| filename:", e[0]["filename"] if e else "-")

print()
print("=== Skan wszystkich .pag ===")


def verify(fn):
    fp = os.path.join(BASE, fn)
    sig = fp + ".asc"
    if not os.path.isfile(sig):
        return (fn, "MISSING_SIG", "")
    r = subprocess.run(["gpg", "--verify", sig, fp], capture_output=True)
    if r.returncode == 0:
        return None
    err = (r.stderr or b"").decode(errors="replace")
    low = err.lower()
    if "no public key" in low or "no_pubkey" in low:
        reason = "NO_PUBKEY"
    elif "bad signature" in low:
        reason = "BAD_SIG"
    else:
        reason = "OTHER"
    last = [l for l in err.strip().splitlines() if l.strip()]
    return (fn, reason, last[-1][:110] if last else "")


files = [f for f in os.listdir(BASE) if f.endswith(".pag")]
print("pakietów:", len(files))
bad = []
with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex:
    for res in ex.map(verify, files):
        if res:
            bad.append(res)
print("problemy:", len(bad))
for fn, reason, msg in bad[:50]:
    print(f"  {reason:10s} {fn} | {msg}")
rc, out, err = sh(["gpg", "--verify", BASE + "/repo.json.asc", BASE + "/repo.json"])
print("repo.json.asc verify rc:", rc, "|", (err or "").strip().splitlines()[-1] if err.strip() else out.strip()[:80])