# -*- coding: utf-8 -*-
"""
verify_rfc3161.py — 验证 RFC3161 时间戳令牌(.tsr) 与原始文件的绑定关系
用法:
    python verify_rfc3161.py <tsr_path> <original_file_path>
若省略参数，默认使用《在场范式》V1.0 的路径（便于快速复验）。
原理:
    .tsr 内的 messageImprint 是对「原始文件哈希」的加盖签名。只要本地重算
    的 SHA256 与令牌内 imprint 完全一致，即证明：该文件内容在 TSA 签署时间
    之前已存在、且此后未被篡改（imprint 绑定验证）。
"""
import sys, hashlib
from asn1crypto.tsp import TimeStampResp

DEFAULT_TSR = r"C:\Users\PC\WorkBuddy\2026-07-11-13-33-42\zai-chang-fan-shi-V1.0.rfc3161.tsr"
DEFAULT_PDF = r"C:\Users\PC\WorkBuddy\2026-06-30-00-00-31\site\core\zai-chang-fan-shi-V1.0-vector-watermarked.pdf"


def sha256_file(path):
    h = hashlib.sha256()
    with open(path, 'rb') as f:
        for chunk in iter(lambda: f.read(65536), b''):
            h.update(chunk)
    return h.hexdigest()


def main():
    tsr_path = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_TSR
    file_path = sys.argv[2] if len(sys.argv) > 2 else DEFAULT_PDF

    print("=" * 64)
    print("RFC3161 时间戳验证")
    print("=" * 64)
    print(f"令牌文件 : {tsr_path}")
    print(f"原始文件 : {file_path}")

    # 1) 本地哈希
    local_sha = sha256_file(file_path)
    print(f"\n[1] 本地 SHA256 :\n{local_sha}")

    # 2) 解析令牌 (纯本地, 无需出网)
    with open(tsr_path, 'rb') as f:
        raw = f.read()
    resp = TimeStampResp.load(raw)
    status = resp['status']['status'].native
    status_ok = (status == 0 or status == 'granted')
    if not status_ok:
        print(f"\n[!] 令牌状态异常: status={status}")
        return
    tsr = resp['time_stamp_token']
    sd = tsr['content']                              # SignedData (CMS)
    ec = sd['encap_content_info']['content'].native  # TSTInfo (OrderedDict)
    gen_time = ec['gen_time']
    serial = ec['serial_number']
    policy = ec['policy']
    mi = ec['message_imprint']
    algo = mi['hash_algorithm']['algorithm']
    imprint = mi['hashed_message']                   # bytes (OCTET STRING 已自动解码)
    imprint_hex = imprint.hex()

    print(f"\n[2] 令牌内 TSTInfo:")
    print(f"    状态      : granted (status={status})" if status_ok else f"    状态      : {status}")
    print(f"    签署时间  : {gen_time.strftime('%Y-%m-%d %H:%M:%S UTC') if hasattr(gen_time, 'strftime') else gen_time}")
    print(f"    序列号    : {serial}")
    print(f"    策略 OID  : {policy}")
    print(f"    摘要算法  : {algo}")
    print(f"    imprint   :\n{imprint_hex}")

    # 3) TSA 证书主题
    try:
        certs = sd['certificates']
        if certs:
            c0 = certs[0].native
            subj = c0['tbs_certificate']['subject']
            cn = subj.get('common_name')
            email = subj.get('email_address')
            line = f"[3] 签署者(TSA): {cn}"
            if email:
                line += f" <{email}>"
            print("\n" + line)
    except Exception as e:
        print(f"\n[3] (证书信息提取略: {e})")

    # 4) 一致性比对 (核心)
    print(f"\n[4] 一致性比对:")
    match = (imprint_hex.lower() == local_sha.lower())
    print(f"    令牌 imprint == 本地 SHA256 ? {'✅ 一致 (MATCH)' if match else '❌ 不一致 (MISMATCH)'}")
    if not match:
        print(f"    本地 SHA256 : {local_sha}")
        print("    => 文件内容已被改动，或令牌不对应此文件。")
    else:
        print("    => 证明: 此文件内容在签署时间之前已存在且未被篡改。")

    print("\n" + "=" * 64)
    print("结论: " + ("验证通过 ✅" if match else "验证失败 ❌"))
    print("=" * 64)

    sys.exit(0 if match else 1)


if __name__ == '__main__':
    main()