#!/usr/bin/env python3
"""Download a pinned official release and verify its published SHA-256 digest."""
import hashlib
import io
import json
from pathlib import Path
import platform
import shutil
import tarfile
import urllib.request

VERSION = "1.14.0"
ROOT = Path(__file__).resolve().parent.parent

def download(url):
    req = urllib.request.Request(url, headers={"User-Agent": "MiniVLESS-build"})
    with urllib.request.urlopen(req, timeout=90) as response:
        return response.read()

def main():
    if platform.system() != "Linux":
        raise SystemExit("MiniVLESS currently supports Linux only")
    arch = {"x86_64": "amd64", "aarch64": "arm64"}.get(platform.machine())
    if arch is None:
        raise SystemExit("Supported CPU architectures: x86_64 and aarch64")
    name = f"sing-box-{VERSION}-linux-{arch}.tar.gz"
    release = json.loads(download(f"https://api.github.com/repos/SagerNet/sing-box/releases/tags/v{VERSION}"))
    asset = next(a for a in release["assets"] if a["name"] == name)
    payload = download(asset["browser_download_url"])
    expected = asset.get("digest")
    if not expected or expected != "sha256:" + hashlib.sha256(payload).hexdigest():
        raise SystemExit("Missing or mismatched SHA-256: refusing to install this download")
    target = ROOT / "binaries/sing-box"
    target.parent.mkdir(exist_ok=True)
    with tarfile.open(fileobj=io.BytesIO(payload)) as archive:
        member = archive.getmember(f"sing-box-{VERSION}-linux-{arch}/sing-box")
        if not member.isfile():
            raise SystemExit("Invalid archive entry")
        with archive.extractfile(member) as src, target.with_suffix(".new").open("wb") as dst:
            shutil.copyfileobj(src, dst)
        license_data = archive.extractfile(f"sing-box-{VERSION}-linux-{arch}/LICENSE").read()
        (target.parent / "LICENSE.sing-box").write_bytes(license_data)
    target.with_suffix(".new").chmod(0o755)
    target.with_suffix(".new").replace(target)
    print(f"Verified sing-box {VERSION}: {target}")
    print("File capabilities must be reapplied after replacing the binary.")

if __name__ == "__main__":
    main()