#!/bin/bash
set -euo pipefail

PACKAGE=${1:?usage: verify-fnos-package.sh package.fpk [expected-version]}
EXPECTED_VERSION=${2:-0.2.25}
VERIFY_TMP_ROOT="${DYSYNC_VERIFY_TMPDIR:-${DYSYNC_TMPDIR:-${TMPDIR:-/tmp}}}"
mkdir -p "${VERIFY_TMP_ROOT}"
WORK_DIR=$(mktemp -d "${VERIFY_TMP_ROOT%/}/dysync-fnos-verify.XXXXXX")
trap 'rm -rf -- "${WORK_DIR}"' EXIT
tar -xzf "${PACKAGE}" -C "${WORK_DIR}"
grep -q "^version[[:space:]]*= ${EXPECTED_VERSION}$" "${WORK_DIR}/manifest"
test -x "${WORK_DIR}/cmd/main"
test -x "${WORK_DIR}/cmd/upgrade_init"
tar -tzf "${WORK_DIR}/app.tgz" > "${WORK_DIR}/app-files.txt"
grep -q '^server/dy.net$' "${WORK_DIR}/app-files.txt"
grep -q '^server/appsettings.json$' "${WORK_DIR}/app-files.txt"
grep -q '^server/libe_sqlite3.so$' "${WORK_DIR}/app-files.txt"
escaped_version=$(printf '%s' "$EXPECTED_VERSION" | sed 's/\./\\./g')
tar -xOzf "${WORK_DIR}/app.tgz" server/appsettings.json | \
    grep -Eq "\"fnVersion\"[[:space:]]*:[[:space:]]*\"${escaped_version}\""
if grep -Eq '^server/(db|keys|upgrade-backups)/' "${WORK_DIR}/app-files.txt"; then
    echo 'Persistent data must not be included in app.tgz' >&2
    exit 1
fi
expected=$(grep '^checksum' "${WORK_DIR}/manifest" | sed 's/.*=[[:space:]]*//')
actual=$(md5sum "${WORK_DIR}/app.tgz" | cut -d' ' -f1)
test "${expected}" = "${actual}"
printf 'fnOS package verified: %s\n' "${PACKAGE}"