#!/usr/bin/env python3
"""Read-only Chainguard documentation check; Python 3, no extra packages.
Sends two HTTPS GET requests. Does not execute downloaded text or modify files.
Verified 2026-11-04. A matching digest checks consistency, not authenticity.
"""
import argparse
import hashlib
import json
import sys
import urllib.error
import urllib.request

BASE = 'https://man.cgr.dev/os/gnutar/1.35-r15/man1/tar.1'
MAX_BYTES = 2_000_000


def fetch(url):
    with urllib.request.urlopen(url, timeout=30) as response:
        data = response.read(MAX_BYTES + 1)
    if len(data) > MAX_BYTES:
        raise ValueError('Document exceeds the size limit')
    return data


def verify(manifest, payload, kind="raw"):
    expected = ('os', 'gnutar', '1.35-r15', '1', 'tar')
    actual = tuple(manifest.get(k) for k in ('repo', 'package', 'version', 'section', 'name'))
    if actual != expected:
        raise ValueError('Unexpected repository, package, version or page')
    digest = 'sha256:' + hashlib.sha256(payload).hexdigest()
    if manifest.get(kind, {}).get('digest') != digest:
        raise ValueError(kind + ' digest mismatch')
    return digest


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--format', choices=('raw', 'markdown'), default='raw')
    args = parser.parse_args()
    try:
        manifest = json.loads(fetch(BASE + '.json'))
        payload = fetch(BASE + ('.raw' if args.format == 'raw' else '.md'))
        digest = verify(manifest, payload, args.format)
    except (OSError, ValueError, urllib.error.URLError) as error:
        print('CHECK FAILED:', error, file=sys.stderr)
        return 1
    print('OK: package=gnutar version=1.35-r15;', args.format, 'SHA256 matches')
    print('Source:', BASE)
    print('Digest:', digest)
    return 0


if __name__ == '__main__':
    sys.exit(main())