// Generate the immutable distributor policy from this build's exact inputs.
package main

import (
 "crypto/sha256"
 "encoding/json"
 "fmt"
 "os"
 "path/filepath"
 "strings"
)
func digest(p string) string { b,e:=os.ReadFile(p); if e!=nil {panic(e)}; return fmt.Sprintf("%x",sha256.Sum256(b)) }
func main() {
 if len(os.Args)!=5 { panic("generate: upstream-dir rebuilt-dir plugins.tsv output.go") }
 rows,e:=os.ReadFile(os.Args[3]);if e!=nil {panic(e)}
 var out strings.Builder
 out.WriteString("// Code generated from exact signed manifests and rebuilt binaries; DO NOT EDIT.\npackage signature\n\nvar distributorBackends = map[string]distributorBackend{\n")
 count:=0
 for _,row:=range strings.Split(strings.TrimSpace(string(rows)),"\n") {
  fields:=strings.Split(row,"\t");if len(fields)!=6 {panic("invalid plugin input row")}
  dir,binary:=fields[0],fields[4]
  if filepath.Base(dir)!=dir || filepath.Base(binary)!=binary || !strings.HasSuffix(binary,"_linux_amd64") {panic("invalid backend path")}
  mpath:=filepath.Join(os.Args[1],dir,"MANIFEST.txt")
  raw,e:=os.ReadFile(mpath);if e!=nil {panic(e)}
  start:=strings.Index(string(raw),"\n\n");end:=strings.Index(string(raw),"\n-----BEGIN PGP SIGNATURE-----");if start<0||end<=start {panic("invalid signed manifest")}
  var manifest struct {Plugin,Version string;Files map[string]string}
  if e=json.Unmarshal(raw[start+2:end],&manifest);e!=nil {panic(e)}
  old:=manifest.Files[binary];if len(old)!=64||manifest.Plugin==""||manifest.Version=="" {panic("manifest missing backend/identity")}
  rebuilt:=digest(filepath.Join(os.Args[2],dir,binary))
  fmt.Fprintf(&out,"%q: {Directory: %q, Version: %q, Binary: %q, UpstreamSHA: %q, RebuiltSHA: %q, ManifestSHA: %q},\n",manifest.Plugin,dir,manifest.Version,binary,old,rebuilt,digest(mpath))
  count++
 }
 if count!=13 {panic("expected exactly thirteen bundled backends")}
 out.WriteString("}\n")
 if e=os.WriteFile(os.Args[4],[]byte(out.String()),0644);e!=nil {panic(e)}
}