#!/usr/bin/env python3
"""Install pinned Linux amd64 validators only; never start proxy services."""
import gzip
import hashlib
import io
import os
from pathlib import Path
import platform
import tarfile
import urllib.request

ASSETS = [
    ('sing-box', 'https://github.com/SagerNet/sing-box/releases/download/v1.14.3/sing-box-1.14.3-linux-amd64.tar.gz', 'e2bdf179c15a3652955dc44867e33ca0965c9c9b91b34267dcc5a5d639a5feee'),
    ('mihomo', 'https://github.com/MetaCubeX/mihomo/releases/download/v1.19.32/mihomo-linux-amd64-v1-v1.19.32.gz', '306f81e723e60ce6b828899a6fe83e1d00e9ecefb2dc8d4d849312a5bc00efdc'),
    ('Country.mmdb', 'https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/country.mmdb', '64809d264be87ecfb7ac3ad19b7678893b6275038a7d4bf9eec72464a6c4f9fe'),
    ('geoip.metadb', 'https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.metadb', 'ec6701e428b7efe610fe40b187a69fb03324892a56792b033adc080d2b6c273e'),
]

def main():
    if platform.system() != 'Linux' or platform.machine() not in ('x86_64', 'amd64'):
        raise RuntimeError('This manifest targets Linux amd64 only')
    root = Path('/opt/master01-freenode/bin')
    root.mkdir(mode=0o755, parents=True, exist_ok=True)
    for name, url, expected in ASSETS:
        if name in ('Country.mmdb', 'geoip.metadb'):
            root = Path('/opt/master01-freenode/data')
            root.mkdir(mode=0o755, parents=True, exist_ok=True)
        else:
            root = Path('/opt/master01-freenode/bin')
        request = urllib.request.Request(url, headers={'User-Agent': 'master01-freenode-validator'})
        with urllib.request.urlopen(request, timeout=60) as response:
            raw = response.read()
        if hashlib.sha256(raw).hexdigest() != expected:
            raise RuntimeError('Official archive checksum mismatch: ' + name)
        if name in ('Country.mmdb', 'geoip.metadb'):
            binary = raw
        elif name == 'sing-box':
            with tarfile.open(fileobj=io.BytesIO(raw), mode='r:gz') as archive:
                member = next(m for m in archive.getmembers() if m.isfile() and m.name.endswith('/sing-box'))
                binary = archive.extractfile(member).read()
        else:
            binary = gzip.decompress(raw)
        temp = root / ('.' + name + '.tmp')
        temp.write_bytes(binary)
        temp.chmod(0o644 if name in ('Country.mmdb', 'geoip.metadb') else 0o755)
        os.replace(temp, root / name)
        print(name + ': archive verified, validator installed', flush=True)

if __name__ == '__main__':
    main()