"""Pinned official EEPROM configuration tool and Pi 5 preview image."""
import fcntl
import hashlib
import json
import os
from pathlib import Path
import subprocess
import tempfile

PROJECT=Path(__file__).resolve().parents[1]

def sha256(path):
    with Path(path).open('rb') as stream:return hashlib.file_digest(stream,'sha256').hexdigest()

def prepare():
    pin=json.loads((PROJECT/'config/eeprom/inputs.json').read_text())
    cache=PROJECT/'.host/eeprom'/pin['commit'];cache.mkdir(parents=True,exist_ok=True)
    with (cache/'.lock').open('a') as lock:
        fcntl.flock(lock,fcntl.LOCK_EX)
        for item in pin['files']:
            target=cache/item['name']
            if not target.exists():
                if os.environ.get('FDS_OFFLINE')=='1':raise ValueError(f'Missing offline EEPROM input: {target}')
                url=f'https://raw.githubusercontent.com/raspberrypi/rpi-eeprom/{pin["commit"]}/{item["path"]}'
                fd,name=tempfile.mkstemp(prefix='.download-',dir=cache);os.close(fd)
                temporary=Path(name)
                try:
                    subprocess.run(['curl','--fail','--location','--silent','--show-error',url,'--output',str(temporary)],check=True)
                    if sha256(temporary)!=item['sha256']:raise ValueError(f'EEPROM input checksum mismatch: {item["name"]}')
                    temporary.replace(target)
                finally:temporary.unlink(missing_ok=True)
            if not target.is_file() or sha256(target)!=item['sha256']:
                raise ValueError(f'Cached EEPROM input changed: {target}')
    return cache,pin