#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "$0")/.." && pwd)"
revision=9f8f6c917885d9ef3d84c17280939c012dea0dfe
archive_checksum=9d96426115f1bf54ef09ba41964c73dc3c809743519c8442016b8dd3fce0889d
patch_file="$root/patches/gvisor-9f8f6c917-directory-handles.patch"
patch_checksum=541420eece9ec7efbef156bdb726744ead6b4d991d41c5560f4fdfe83fb2357a
bazel_version=8.3.1
module_lock="$root/patches/gvisor-9f8f6c917-MODULE.bazel.lock"
module_checksum=8402c7beb4baf2c666f4b78e400ea3f15514b56117598c2cb5411d6a35208d34
build_id=904ab3c9bd4c99a27181076f2c9ea2fecc041db5a728c999540d6664174d2cd4
archive="$root/.lazaret/cache/gvisor-$revision.tar.gz"
source="$root/.lazaret/vendor/gvisor-$build_id"
binary="$root/.lazaret/bin/lazaret-runsc-$build_id"
mode=source

if [[ "${1:-}" == "--build" && $# -eq 1 ]]; then
    mode=build
elif [[ "${1:-}" == "--test" && $# -eq 1 ]]; then
    mode=test
elif [[ $# -ne 0 ]]; then
    printf '%s\n' 'usage: tools/materialize-runsc [--build|--test]' >&2
    exit 2
fi

fail() {
    printf 'materialize-runsc: %s\n' "$*" >&2
    exit 1
}

for command in curl make patch sha256sum tar; do
    command -v "$command" >/dev/null 2>&1 || fail "$command is required"
done

[[ -f "$patch_file" ]] || fail "missing patch: $patch_file"
[[ "$(sha256sum "$patch_file" | cut -d ' ' -f 1)" == "$patch_checksum" ]] ||
    fail 'patch checksum mismatch'
[[ -f "$module_lock" ]] || fail "missing module lock: $module_lock"
[[ "$(sha256sum "$module_lock" | cut -d ' ' -f 1)" == "$module_checksum" ]] ||
    fail 'module lock checksum mismatch'

stamp="$revision $archive_checksum $patch_checksum $bazel_version $module_checksum $build_id"
if [[ ! -f "$source/.lazaret-materialization" ]]; then
    mkdir -p "$root/.lazaret/cache" "$root/.lazaret/vendor"
    if [[ ! -f "$archive" ]]; then
        partial="$archive.partial.$$"
        trap 'rm -f "$partial"' EXIT
        curl --fail --location --output "$partial" \
            "https://codeload.github.com/google/gvisor/tar.gz/$revision"
        [[ "$(sha256sum "$partial" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
            fail 'downloaded archive checksum mismatch'
        mv "$partial" "$archive"
        trap - EXIT
    fi
    [[ "$(sha256sum "$archive" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
        fail 'cached archive checksum mismatch'
    temporary="$(mktemp -d "$root/.lazaret/vendor/.gvisor-$build_id.XXXXXX")"
    trap 'rm -rf "$temporary"' EXIT
    tar -xzf "$archive" -C "$temporary"
    extracted="$temporary/gvisor-$revision"
    [[ -d "$extracted" ]] || fail 'archive has an unexpected root directory'
    patch --directory="$extracted" --strip=1 --batch --forward <"$patch_file"
    [[ "$(tr -d '\n' <"$extracted/.bazelversion")" == "$bazel_version" ]] ||
        fail 'Bazel version mismatch'
    install -m 0644 "$module_lock" "$extracted/MODULE.bazel.lock"
    printf '%s\n' "$stamp" >"$extracted/.lazaret-materialization"
    [[ ! -e "$source" ]] || fail 'immutable source destination already exists without a valid stamp'
    mv "$extracted" "$source"
    trap - EXIT
elif [[ "$(tr -d '\n' <"$source/.lazaret-materialization")" != "$stamp" ]]; then
    fail 'materialized source identity mismatch'
fi

if [[ "$mode" == test ]]; then
    make -C "$source" test TARGETS=//pkg/sentry/fsimpl/gofer:gofer_test
fi
if [[ "$mode" != source ]]; then
    make -C "$source" build TARGETS=//runsc:runsc
    built="$source/bazel-bin/runsc/runsc_/runsc"
    [[ -x "$built" ]] || fail 'canonical build did not produce runsc'
    version_output="$($built --version 2>&1)"
    [[ "$version_output" == $'runsc version 0.0.0\nspec: 1.2.1' ]] ||
        fail 'built runsc reports an unexpected version'
    mkdir -p "$root/.lazaret/bin"
    if [[ ! -e "$binary" ]]; then
        temporary_binary="$root/.lazaret/bin/.lazaret-runsc-$build_id.$$"
        trap 'rm -f "$temporary_binary"' EXIT
        install -m 0755 "$built" "$temporary_binary"
        mv "$temporary_binary" "$binary"
        trap - EXIT
    fi
    [[ -x "$binary" ]] || fail 'materialized runsc is not executable'
    sha256sum "$binary" >"$binary.sha256"
    printf '%s\n' "$binary"
fi