package main

import (
	"context"
	"crypto"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"encoding/base64"
	"flag"
	"fmt"
	"os"

	rekor_note "github.com/sigstore/rekor-tiles/pkg/note"
	"github.com/sigstore/sigstore/pkg/signature"
	f_note "github.com/transparency-dev/formats/note"
	"golang.org/x/mod/sumdb/note"
)

var (
	checkpointPath = flag.String("checkpoint", "", "path to transparency log checkpoint to sign with additional signers")
	origin         = flag.String("origin", "", "origin of the checkpoint")
	pubKeyPath     = flag.String("pubkey", "", "path to public key to verify checkpoint")
)

func main() {
	flag.Parse()

	if *checkpointPath == "" || *origin == "" || *pubKeyPath == "" {
		flag.Usage()
		return
	}
	checkpoint, err := os.ReadFile(*checkpointPath)
	if err != nil {
		panic(err)
	}
	pubKey, err := os.ReadFile(*pubKeyPath)
	if err != nil {
		panic(err)
	}

	// Parse checkpoint
	pkixPubKey, err := base64.StdEncoding.DecodeString(string(pubKey))
	if err != nil {
		panic(err)
	}
	pub, err := x509.ParsePKIXPublicKey(pkixPubKey)
	if err != nil {
		panic(err)
	}
	sigVer, err := signature.LoadVerifier(pub, crypto.SHA256)
	if err != nil {
		panic(err)
	}
	nv, err := rekor_note.NewNoteVerifier(*origin, sigVer)
	if err != nil {
		panic(err)
	}
	n, err := note.Open(checkpoint, note.VerifierList(nv))
	if err != nil {
		panic(err)
	}

	// Generate two additional signatures, one for the same origin to simulate PQC signing...
	sv, _, err := signature.NewECDSASignerVerifier(elliptic.P256(), rand.Reader, crypto.SHA256)
	if err != nil {
		panic(err)
	}
	addNoteSigner, err := rekor_note.NewNoteSigner(context.Background(), *origin, sv)
	if err != nil {
		panic(err)
	}
	aaNoteVerifier, err := rekor_note.NewNoteVerifier(*origin, sv)
	if err != nil {
		panic(err)
	}
	// ...and one for a witness cosignature
	skey, vkey, err := note.GenerateKey(rand.Reader, "witness.example/w1")
	if err != nil {
		panic(err)
	}
	coSigner, err := f_note.NewSignerForCosignatureV1(skey)
	if err != nil {
		panic(err)
	}
	coVerifier, err := f_note.NewVerifierForCosignatureV1(vkey)
	if err != nil {
		panic(err)
	}
	skey2, vkey2, err := note.GenerateKey(rand.Reader, "witness.example/w2")
	if err != nil {
		panic(err)
	}
	coSigner2, err := f_note.NewSignerForCosignatureV1(skey2)
	if err != nil {
		panic(err)
	}
	coVerifier2, err := f_note.NewVerifierForCosignatureV1(vkey2)
	if err != nil {
		panic(err)
	}

	// Sign checkpoint with additional signers
	signedNote, err := note.Sign(n, addNoteSigner, coSigner, coSigner2)
	if err != nil {
		panic(err)
	}

	// Verify note with all verifiers
	verifiedNote, err := note.Open(signedNote, note.VerifierList(nv, aaNoteVerifier, coVerifier, coVerifier2))
	if err != nil {
		panic(err)
	}
	if len(verifiedNote.Sigs) != 4 {
		panic("expected 4 signatures")
	}

	fmt.Println(string(signedNote))
}