from typing import Optional
from cryptography.x509 import ExtensionNotFound, ObjectIdentifier, SubjectAlternativeName, UniformResourceIdentifier
from sigstore._verify import Verifier, VerificationResult, VerificationFailure

GITHUB_ACTIONS_ISSUER = "https://token.actions.githubusercontent.com"
OIDC_GITHUB_WORKFLOW_SHA_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.3")
OIDC_GITHUB_WORKFLOW_REPOSITORY_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.5")

def verify_github(filename: str, expected_repo: str, expected_workflow: str, expected_tag: str, expected_sha: Optional[str]) -> VerificationResult:
    with open(filename, "rb") as f:
        input_ = f.read()
    with open(f"{filename}.crt", "rb") as f:
        cert = f.read()
    with open(f"{filename}.sig", "rb") as f:
        sig = f.read()
    
    verifier = Verifier.production()

    # Verify that signature is correct and issuer is GitHub
    result = verifier.verify_base(input_, cert, sig, GITHUB_ACTIONS_ISSUER)
    if not result:
        return result

    extensions = result.certificate.extensions
    san_ext = extensions.get_extension_for_class(SubjectAlternativeName)
    sans = san_ext.value.get_values_for_type(UniformResourceIdentifier)
    try:
        repository = extensions.get_extension_for_oid(OIDC_GITHUB_WORKFLOW_REPOSITORY_OID).value
        sha = extensions.get_extension_for_oid(OIDC_GITHUB_WORKFLOW_SHA_OID).value
    except ExtensionNotFound:
        return VerificationFailure(reason="Certificate does not contain a required GitHub extension")

    # Verify the signer identity
    expected_san = f"https://github.com/{expected_repo}/{expected_workflow}@refs/tags/{expected_tag}"
    if expected_san not in sans:
        return VerificationFailure(reason=f"Expected subject name '{expected_san}', got '{sans}'")
    
    # Verify the repository
    if repository.value != expected_repo.encode():
        return VerificationFailure(
            reason=f"Certificate's workflow repository does not match (got {repository.value})"
        )

    # Verify SHA
    if expected_sha:
        if sha.value != expected_sha.encode():
            return VerificationFailure(
                reason=f"Certificate's workflow SHA does not match (got {sha.value})"
            )

    # All good!
    return result

verify_github(
    "sigstore-0.6.3-py3-none-any.whl"
    "sigstore/sigstore-python",
    ".github/workflows/release.yml",
    "v0.6.3",
    "bff2e635da74627b62b31efd746f533bf97801ed"
)