WARN: Platform filtering with the Platforms field requires a registry with manifest
      list blob check disabled (e.g. validation.manifests.indexes.platforms: none).

invalid configuration: platform.platforms and platform.architectures cannot be used together

#!/usr/bin/env bash
# verify-platform-filter.sh
#
# Verify which platform blobs are actually stored in a registry for manifest-list images.
# Sparse manifest registries store the full index but may omit blobs for unselected platforms.
# This script distinguishes PRESENT (blob reachable) from MISSING (listed in index but no blob).
#
# Usage:
#   # Report all manifest-list images and their blob presence:
#   ./scripts/verify-platform-filter.sh localhost:6000
#
#   # Validate that no image has blobs outside the expected set (fail on unexpected extras only;
#   # single-arch images with fewer platforms than expected are fine):
#   ./scripts/verify-platform-filter.sh localhost:6000 linux/amd64 linux/arm64
#
#   # Side-by-side comparison of two registries (useful to spot the filtering effect):
#   ./scripts/verify-platform-filter.sh --compare localhost:5000 localhost:6000
#
#   # Side-by-side comparison AND validate the second registry against expected platforms:
#   ./scripts/verify-platform-filter.sh --compare localhost:5000 localhost:6000 linux/amd64 linux/arm64

set -euo pipefail

# ── colours ───────────────────────────────────────────────────────────────────
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
CYAN='\033[0;36m'; BOLD='\033[1m'; RESET='\033[0m'

# ── helpers ───────────────────────────────────────────────────────────────────
die()  { echo -e "${RED}ERROR: $*${RESET}" >&2; exit 1; }
info() { echo -e "${CYAN}$*${RESET}"; }
ok()   { echo -e "    ${GREEN}✔ $*${RESET}"; }
fail() { echo -e "    ${RED}✘ $*${RESET}"; }
warn() { echo -e "    ${YELLOW}~ $*${RESET}"; }

require() { command -v "$1" &>/dev/null || die "$1 is required but not installed."; }
require curl
require python3

# ── registry helpers ──────────────────────────────────────────────────────────

# List all repositories in a registry.
list_repos() {
    curl -sf "http://${1}/v2/_catalog" \
        | python3 -c "import json,sys; [print(r) for r in json.load(sys.stdin).get('repositories',[])]"
}

# List non-signature tags for an image (skip *.sig tags, which are Cosign signatures).
list_tags() {
    local reg=$1 image=$2
    curl -sf "http://${reg}/v2/${image}/tags/list" \
        | python3 -c "
import json,sys
for t in (json.load(sys.stdin).get('tags') or []):
    if not t.endswith('.sig'):
        print(t)
"
}

# Fetch a manifest, accepting both manifest-list and single-manifest media types.
fetch_manifest() {
    local reg=$1 image=$2 ref=$3
    curl -sf \
        -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json" \
        "http://${reg}/v2/${image}/manifests/${ref}"
}

# Return 0 if the manifest/blob for a digest is reachable (HTTP 200).
digest_present() {
    local reg=$1 image=$2 digest=$3
    local http_code
    http_code=$(curl -so /dev/null -w "%{http_code}" \
        -H "Accept: application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json" \
        "http://${reg}/v2/${image}/manifests/${digest}")
    [[ "$http_code" == "200" ]]
}

# Extract tab-separated "digest  os  arch  variant" lines from a manifest list JSON.
manifest_entries() {
    python3 -c "
import json,sys
m=json.load(sys.stdin)
for e in m.get('manifests',[]):
    p=e.get('platform',{})
    print(e['digest'] + '\t' + p.get('os','?') + '\t' + p.get('architecture','?') + '\t' + p.get('variant',''))
"
}

# ── check one image ───────────────────────────────────────────────────────────
#
# Prints a block like:
#   image:tag
#     ✔ linux/amd64
#     ✘ linux/s390x (blob missing)
#
# Sets globals: IS_INDEX, PRESENT_COUNT, MISSING_COUNT
# Returns 1 if any expected platform is missing or an unexpected one is present.
check_image() {
    local reg=$1 image=$2 tag=$3
    shift 3
    local -a expected_platforms=("$@")

    IS_INDEX=0 PRESENT_COUNT=0 MISSING_COUNT=0

    local manifest
    manifest=$(fetch_manifest "$reg" "$image" "$tag" 2>/dev/null) || return 0

    local has_manifests
    has_manifests=$(echo "$manifest" | python3 -c "import json,sys; print('yes' if 'manifests' in json.load(sys.stdin) else 'no')" 2>/dev/null)
    [[ "$has_manifests" == "yes" ]] || return 0   # single-manifest — nothing to check

    IS_INDEX=1

    # Collect per-platform results before printing so the header can come first.
    local -a lines=()
    local -a present_platforms=()

    while IFS=$'\t' read -r digest os arch variant; do
        local plat="${os}/${arch}"
        [[ -n "$variant" ]] && plat="${plat}/${variant}"

        if digest_present "$reg" "$image" "$digest"; then
            lines+=("ok:${plat}")
            present_platforms+=("$plat")
            (( PRESENT_COUNT++ )) || true
        else
            lines+=("fail:${plat}")
            (( MISSING_COUNT++ )) || true
        fi
    done < <(echo "$manifest" | manifest_entries)

    # Print header with summary counts.
    echo -e "  ${BOLD}${image}:${tag}${RESET}  [${PRESENT_COUNT} present, ${MISSING_COUNT} missing]"

    # Print per-platform lines.
    for line in "${lines[@]}"; do
        local status="${line%%:*}" plat="${line#*:}"
        if [[ "$status" == "ok" ]]; then
            ok "$plat"
        else
            fail "$plat (blob missing)"
        fi
    done

    # Validate against expected platforms if provided.
    # Only fails on UNEXPECTED platforms (present but not in the allowed set).
    # An image having fewer platforms than expected is fine — it may be single-arch.
    if (( ${#expected_platforms[@]} > 0 )); then
        local img_fail=0

        for got in "${present_platforms[@]}"; do
            local expected_flag=0
            for exp in "${expected_platforms[@]}"; do
                # Match exact or prefix (e.g. linux/arm64 matches linux/arm64/v8).
                [[ "$got" == "$exp" || "$got" == "${exp}/"* ]] && expected_flag=1 && break
            done
            (( expected_flag )) || { fail "UNEXPECTED platform present: ${got}"; img_fail=1; }
        done

        return $img_fail
    fi
}

# ── report mode ───────────────────────────────────────────────────────────────

report_registry() {
    local reg=$1
    shift
    local -a expected_platforms=("$@")
    local total_images=0 total_index=0 total_missing=0 total_fail=0

    info "\n=== Registry: ${reg} ==="
    if (( ${#expected_platforms[@]} > 0 )); then
        echo -e "  Expected platforms: ${BOLD}${expected_platforms[*]}${RESET}"
    fi
    echo ""

    while read -r repo; do
        while read -r tag; do
            (( total_images++ )) || true

            if ! check_image "$reg" "$repo" "$tag" "${expected_platforms[@]}"; then
                (( total_fail++ )) || true
            fi

            if (( IS_INDEX )); then
                (( total_index++ )) || true
                (( total_missing += MISSING_COUNT )) || true
            fi
        done < <(list_tags "$reg" "$repo")
    done < <(list_repos "$reg")

    echo ""
    if (( ${#expected_platforms[@]} > 0 )); then
        if (( total_fail == 0 )); then
            echo -e "${GREEN}${BOLD}PASS — all ${total_index} manifest list(s) match expected platforms${RESET}"
        else
            echo -e "${RED}${BOLD}FAIL — ${total_fail} image(s) have platform mismatches${RESET}"
            return 1
        fi
    else
        echo "Scanned ${total_images} image(s). ${total_index} are manifest lists, ${total_missing} missing blobs total."
    fi
}

# ── compare mode ─────────────────────────────────────────────────────────────

compare_registries() {
    local reg1=$1 reg2=$2
    shift 2
    local -a expected_platforms=("$@")

    info "\n=== Comparing ${reg1}  ↔  ${reg2} ==="
    if (( ${#expected_platforms[@]} > 0 )); then
        echo -e "  Validating ${reg2} against: ${BOLD}${expected_platforms[*]}${RESET}"
    fi
    echo ""

    local total=0 diff_count=0 fail_count=0

    # Helper: return newline-separated list of platforms whose blobs are present.
    get_present_platforms() {
        local reg=$1 image=$2 tag=$3
        local manifest
        manifest=$(fetch_manifest "$reg" "$image" "$tag" 2>/dev/null) || return 0
        echo "$manifest" | python3 -c "
import json,sys,urllib.request,urllib.error
m=json.load(sys.stdin)
if 'manifests' not in m: exit(0)
reg='${1}'; im='${2}'
for e in m.get('manifests',[]):
    p=e.get('platform',{})
    plat=p.get('os','?')+'/'+p.get('architecture','?')
    v=p.get('variant','')
    if v: plat+='/'+v
    try:
        req=urllib.request.Request(
            f'http://{reg}/v2/{im}/manifests/'+e['digest'],
            headers={'Accept':'application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json'})
        urllib.request.urlopen(req)
        print(plat)
    except urllib.error.HTTPError:
        pass
"
    }

    while read -r repo; do
        while read -r tag; do
            # Check if it's a manifest list in reg1.
            local manifest1
            manifest1=$(fetch_manifest "$reg1" "$repo" "$tag" 2>/dev/null) || continue
            local is_index
            is_index=$(echo "$manifest1" | python3 -c "import json,sys; print('yes' if 'manifests' in json.load(sys.stdin) else 'no')" 2>/dev/null)
            [[ "$is_index" == "yes" ]] || continue

            (( total++ )) || true
            echo -e "  ${BOLD}${repo}:${tag}${RESET}"

            local -a p1 p2
            mapfile -t p1 < <(get_present_platforms "$reg1" "$repo" "$tag")
            mapfile -t p2 < <(get_present_platforms "$reg2" "$repo" "$tag")

            # Union of all platforms across both registries.
            local -A all_plats=()
            for p in "${p1[@]}"; do all_plats["$p"]=1; done
            for p in "${p2[@]}"; do all_plats["$p"]=1; done

            local differs=0
            for plat in $(echo "${!all_plats[@]}" | tr ' ' '\n' | sort); do
                local in1=0 in2=0
                for p in "${p1[@]}"; do [[ "$p" == "$plat" ]] && in1=1; done
                for p in "${p2[@]}"; do [[ "$p" == "$plat" ]] && in2=1; done

                local r1_mark r2_mark
                (( in1 )) && r1_mark="${GREEN}✔${RESET}" || r1_mark="${YELLOW}—${RESET}"
                (( in2 )) && r2_mark="${GREEN}✔${RESET}" || r2_mark="${YELLOW}—${RESET}"

                echo -e "    ${plat}  (${reg1}: ${r1_mark}  ${reg2}: ${r2_mark})"
                (( in1 != in2 )) && differs=1
            done
            (( differs )) && (( diff_count++ )) || true

            # Validate reg2 against expected platforms if provided.
            # Only fails on UNEXPECTED platforms (present but not in the allowed set).
            if (( ${#expected_platforms[@]} > 0 )); then
                local img_fail=0
                for got in "${p2[@]}"; do
                    local expected_flag=0
                    for exp in "${expected_platforms[@]}"; do
                        [[ "$got" == "$exp" || "$got" == "${exp}/"* ]] && expected_flag=1 && break
                    done
                    (( expected_flag )) || { fail "${reg2} has UNEXPECTED: ${got}"; img_fail=1; }
                done
                (( img_fail )) && (( fail_count++ )) || true
            fi

            echo ""
        done < <(list_tags "$reg1" "$repo")
    done < <(list_repos "$reg1")

    echo "Scanned ${total} manifest list(s). ${diff_count} differ between registries."
    if (( ${#expected_platforms[@]} > 0 )); then
        if (( fail_count > 0 )); then
            echo -e "${RED}${BOLD}FAIL — ${fail_count} image(s) in ${reg2} don't match expected platforms${RESET}"
            return 1
        else
            echo -e "${GREEN}${BOLD}PASS — ${reg2} matches expected platforms on all manifest lists${RESET}"
        fi
    fi
}

# ── main ──────────────────────────────────────────────────────────────────────

usage() {
    grep '^# ' "$0" | sed 's/^# //' | grep -v '^$'
    exit 1
}

if [[ $# -eq 0 ]]; then usage; fi

if [[ "$1" == "--compare" ]]; then
    shift
    [[ $# -lt 2 ]] && die "--compare requires two registry arguments"
    reg1=$1; reg2=$2; shift 2
    compare_registries "$reg1" "$reg2" "$@"
else
    reg=$1; shift
    report_registry "$reg" "$@"
fi