#!/usr/bin/env python3
"""Validate the complete Alpine mirror against the tracked manifest."""
import hashlib,json,sys
from pathlib import Path

def main():
 root=Path(__file__).resolve().parents[1]
 manifest=json.loads((root/'state/manifest.json').read_text())
 files=manifest.get('files',{})
 if not files: raise ValueError('No manifest entries')
 for rel,entry in files.items():
  p=(root/'data/secdb'/rel).resolve()
  if not p.is_relative_to((root/'data/secdb').resolve()): raise ValueError('Unsafe path')
  b=p.read_bytes()
  if hashlib.sha256(b).hexdigest()!=entry['sha256']: raise ValueError('Hash mismatch: '+rel)
  obj=json.loads(b)
  if not isinstance(obj,dict) or not isinstance(obj.get('packages'),list): raise ValueError('Invalid secdb data: '+rel)
  if len(obj['packages'])!=entry['packages']: raise ValueError('Package count mismatch: '+rel)
 print(f'Validated {len(files)} Alpine security database files')
if __name__=='__main__':
 try: main()
 except Exception as e: print(f'Validation failed: {e}',file=sys.stderr);sys.exit(1)