#!/usr/bin/env python3
"""S3: verify a Flamenet Messenger APK against your own build of the source.

Two clean builds of this repo produce byte-identical CONTENTS; only the APK
Signing Block differs, because the signature algorithm is randomized. So the
honest check is entry-by-entry, plus the certificate:

    ./gradlew clean :app:assembleRelease
    python3 scripts-verify-build.py app/build/outputs/apk/release/app-release.apk \
        /path/to/downloaded/flamenet-messenger.apk

Exit 0 and "CONTENTS MATCH" means every file inside the shipped APK is the
one your compiler produced from this source. Check the signer separately:
    apksigner verify --print-certs <apk>
should show CN=Flamenet Messenger, O=Extant 2000 LLC with the fingerprint
printed on the download page.
"""
import hashlib, sys, zipfile

if len(sys.argv) != 3:
    print(__doc__)
    sys.exit(2)

a, b = zipfile.ZipFile(sys.argv[1]), zipfile.ZipFile(sys.argv[2])
na, nb = set(a.namelist()), set(b.namelist())
ok = True
if na != nb:
    print("entry lists differ:", sorted(na ^ nb)[:20])
    ok = False
for n in sorted(na & nb):
    if hashlib.sha256(a.read(n)).digest() != hashlib.sha256(b.read(n)).digest():
        print("differs:", n)
        ok = False
print("CONTENTS MATCH" if ok else "CONTENTS DIFFER")
sys.exit(0 if ok else 1)