# Pin the ONE signer we trust, by public key, taken from a receipt we know is genuine.
# Optional second argument: a minimum assurance level to require.
import json, sys
pub = json.load(open(sys.argv[1]))["signature"]["public_key_b64"]
policy = {
    "schema": "proofbundle/trust-policy/v0.1",
    "policy_id": "lab-pin-ci-eval-runner-01",
    "policyPurpose": "eval",
    "allowed_schema_versions": ["proofbundle/v0.1"],
    "allowed_issuers": [{"issuer": "ci-eval-runner-01", "public_key_b64": pub, "kid": "lab-2026"}],
    "signature": {"allowed_algs": ["ed25519"], "require_expected_signer": True},
    "merkle": {"required_hash_alg": "sha256-rfc6962"},
}
out = "trust_policy.json"
if len(sys.argv) > 2:
    policy["assurance"] = {"minimum_level": sys.argv[2], "reject_self_attested_without_prereg": True}
    out = f"trust_policy_{sys.argv[2]}.json"
json.dump(policy, open(out, "w"), indent=2)
print("wrote", out, "pinning", pub)