"""Validate classic config IDs against containerd manifest IDs without changing release pins."""
import hashlib
import json
import os
from .core import docker, run, require, absolute, KitError


def resolve(reference, expected, *, search=True):
    code,raw=docker('image','inspect','--format','{{json .}}',reference,check=False)
    if code:
        require('No such image' in raw,'IMAGE_QUERY','로컬 이미지 조회 실패. load로 우회하지 않습니다.')
        # Classic config IDs are not addressable as image IDs in containerd stores.
        if search and reference==expected:
            _,listing=docker('image','ls','-q','--no-trunc')
            ids=set(listing.split())
            require(len(ids)<=64,'IMAGE_INVENTORY_LIMIT','이미지 식별 조회 상한 초과')
            for iid in sorted(ids):
                try:
                    matched=resolve(iid,expected,search=False)
                    if matched:return matched
                except KitError as exc:
                    if exc.code!='IMAGE_HASH':raise
        return None
    d=json.loads(raw);actual=d['Id']
    if actual==expected:return actual
    desc=d.get('Descriptor') or {}
    require(desc.get('digest')==actual and desc.get('mediaType') in (
        'application/vnd.oci.image.manifest.v1+json','application/vnd.docker.distribution.manifest.v2+json'),
        'IMAGE_HASH','image ID 차이의 manifest 근거가 없습니다.')
    sock=absolute(os.environ.get('CONTEXTRA_CONTAINERD_SOCKET','/run/containerd/containerd.sock'),no_symlinks=True)
    _,content=run(['ctr','--address',str(sock),'--namespace','moby','content','get',actual],limit=1024*1024)
    require('sha256:'+hashlib.sha256(content.encode()).hexdigest()==actual,'IMAGE_MANIFEST_HASH','manifest 내용 hash 불일치')
    require(json.loads(content).get('config',{}).get('digest')==expected,'IMAGE_HASH','manifest의 config가 승인 image와 다릅니다.')
    return actual