#!/usr/bin/env python3
"""Verify a SiBIL signed report: python3 verify.py REPORT.json PUBKEY_HEX
Needs: pip install cryptography"""
import hashlib, json, sys
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature

env = json.load(open(sys.argv[1]))
pub = bytes.fromhex(sys.argv[2])
if hashlib.sha256(pub).hexdigest()[:16] != env["key_id"]:
    sys.exit("FAIL: key_id does not match the public key")
msg = json.dumps(env["payload"], sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
if hashlib.sha256(msg).hexdigest() != env["payload_sha256"]:
    sys.exit("FAIL: the report was changed (payload_sha256)")
sig = bytes.fromhex(env["sig"])
der = encode_dss_signature(int.from_bytes(sig[:32], "big"), int.from_bytes(sig[32:], "big"))
ec.EllipticCurvePublicKey.from_encoded_point(ec.SECP256R1(), pub).verify(der, msg, ec.ECDSA(hashes.SHA256()))
p = env["payload"]
print(f"OK: run {p['run_id']} score {p['sibil_score']} signed by key {env['key_id']}")