#!/usr/bin/env bash
set -euo pipefail

PACKAGE=${1:?usage: verify-fnos-package.sh package.fpk [expected-version]}
EXPECTED_VERSION=${2:-}
VERIFY_ROOT=${IMAGEFIND_VERIFY_TMPDIR:-${TMPDIR:-/tmp}}
mkdir -p "$VERIFY_ROOT"
work_dir=$(mktemp -d "${VERIFY_ROOT%/}/imagefind-fnos-verify.XXXXXX")
trap 'rm -rf -- "$work_dir"' EXIT

tar -xzf "$PACKAGE" -C "$work_dir"
value() { sed -n "s/^$1[[:space:]]*=[[:space:]]*//p" "$work_dir/manifest" | head -n 1 | tr -d '\r'; }
test "$(value appname)" = imagefind
version=$(value version)
test -n "$version"
if [ -n "$EXPECTED_VERSION" ]; then test "$version" = "$EXPECTED_VERSION"; fi
test "$(value platform)" = x86
test "$(value install_dep_apps)" = python312,nxsir.postgresql
test -x "$work_dir/cmd/main"
test -s "$work_dir/app.tgz"
gzip -t "$work_dir/app.tgz"
tar -tzf "$work_dir/app.tgz" >"$work_dir/files.txt"
grep -q '^frontend/index.html$' "$work_dir/files.txt"
grep -q '^runtime/imagefind-.*\.whl$' "$work_dir/files.txt"
grep -q '^runtime/wheels/.*\.whl$' "$work_dir/files.txt"
grep -q '^bin/libOpenCL.so.1$' "$work_dir/files.txt"
runtime_version=$(tar -xOzf "$work_dir/app.tgz" runtime/VERSION | sed -n '1p')
test "$runtime_version" = "$version"
runtime_app_version=$(tar -xOzf "$work_dir/app.tgz" runtime/VERSION | sed -n '2p')
runtime_package_id=$(tar -xOzf "$work_dir/app.tgz" runtime/VERSION | sed -n '3p')
test -n "$runtime_app_version"
test "${#runtime_package_id}" -eq 64
grep -q "^runtime/imagefind-${runtime_app_version}-.*\\.whl$" "$work_dir/files.txt"
if grep -Eq '^(data|models|cache|postgresql)/' "$work_dir/files.txt"; then
    printf 'persistent data must not be included in ImageFind app.tgz\n' >&2
    exit 1
fi
test -s "$PACKAGE.sha256"
(cd "$(dirname "$PACKAGE")" && sha256sum --check --status "$(basename "$PACKAGE").sha256")
printf 'ImageFind fnOS package verified: %s (%s)\n' "$PACKAGE" "$version"