"""The platform images of a published reference, for bin/sign.sh.

An index (base-os, a released netork image) lists them; a single manifest (a
netork dev image) is one itself, its architecture in its config. Each line out
is ``<arch> <digest>``. Only amd64 and arm64 are built, so anything else, or
nothing at all, is an error rather than a quiet skip.

    python -m image_tools.platforms <digest> <raw.json> <image.json>

``raw.json`` is ``docker buildx imagetools inspect --raw``, ``image.json`` its
``--format '{{json .Image}}'``, and ``<digest>`` the reference's own.
"""

from __future__ import annotations

import argparse
import json
from pathlib import Path

BUILT = ("amd64", "arm64")
INDEXES = (
    "application/vnd.oci.image.index.v1+json",
    "application/vnd.docker.distribution.manifest.list.v2+json",
)


def _checked(arch: str) -> str:
    if arch not in BUILT:
        raise ValueError(f"{arch} is not a platform built here ({', '.join(BUILT)})")
    return arch


def platforms(raw: str, image: str, digest: str) -> list[tuple[str, str]]:
    """``(arch, digest)`` of every platform image behind the reference."""
    manifest = json.loads(raw)
    if manifest.get("mediaType") in INDEXES or "manifests" in manifest:
        found = []
        for entry in manifest.get("manifests") or []:
            platform = entry.get("platform") or {}
            if platform.get("os") != "linux":
                continue  # buildx's attestation manifests say "unknown"
            found.append((_checked(platform.get("architecture", "")), entry["digest"]))
    else:
        arch = (json.loads(image) or {}).get("architecture")
        found = [(_checked(arch), digest)] if arch else []
    if not found:
        raise ValueError("the reference holds no platform image to sign")
    return found


def main() -> int:  # pragma: no cover - CLI seam
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("digest")
    parser.add_argument("raw")
    parser.add_argument("image")
    args = parser.parse_args()
    found = platforms(Path(args.raw).read_text(), Path(args.image).read_text(), args.digest)
    for arch, digest in found:
        print(arch, digest)
    return 0


if __name__ == "__main__":  # pragma: no cover
    raise SystemExit(main())