#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "$0")/.." && pwd)"
revision=9f8f6c917885d9ef3d84c17280939c012dea0dfe
archive_checksum=9d96426115f1bf54ef09ba41964c73dc3c809743519c8442016b8dd3fce0889d
patch_files=(
    "$root/patches/gvisor-9f8f6c917-directory-handles.patch"
    "$root/patches/gvisor-9f8f6c917-private-ownership.patch"
    "$root/patches/gvisor-9f8f6c917-per-description-file-handles.patch"
    "$root/patches/gvisor-9f8f6c917-hostinet-recv-flags.patch"
)
patch_checksums=(
    541420eece9ec7efbef156bdb726744ead6b4d991d41c5560f4fdfe83fb2357a
    79a8c98502d3bb7c254ffb0885dbd26afffac227d04a0091ff91383df0842561
    2403efb81df3185145d18ebdf8d511252fbc2fb414bae4746d7fe471ec4ea9d9
    d3f49a22fe60955d422f63557bc16907fdf65dff368dff296af5535a67b76e74
)
patch_digest=bd37be0b8303f3a1248abc1fc898bb2cc513bad1404743428f8e9be99cbafc84
bazel_version=8.3.1
module_lock="$root/patches/gvisor-9f8f6c917-MODULE.bazel.lock"
module_checksum=8402c7beb4baf2c666f4b78e400ea3f15514b56117598c2cb5411d6a35208d34
build_id=34ed2f67fc55ef97a0b1755b4a94ed682f6aae57a41ce27eceb66ea366185ca7
archive="$root/.lazaret/cache/gvisor-$revision.tar.gz"
source="$root/.lazaret/vendor/gvisor-$build_id"
binary="$root/.lazaret/bin/lazaret-runsc-$build_id"
mode=source

if [[ "${1:-}" == "--build" && $# -eq 1 ]]; then
    mode=build
elif [[ "${1:-}" == "--test" && $# -eq 1 ]]; then
    mode=test
elif [[ $# -ne 0 ]]; then
    printf '%s\n' 'usage: tools/materialize-runsc [--build|--test]' >&2
    exit 2
fi

fail() {
    printf 'materialize-runsc: %s\n' "$*" >&2
    exit 1
}

for command in curl make patch sha256sum tar; do
    command -v "$command" >/dev/null 2>&1 || fail "$command is required"
done

for index in "${!patch_files[@]}"; do
    patch_file="${patch_files[$index]}"
    [[ -f "$patch_file" ]] || fail "missing patch: $patch_file"
    [[ "$(sha256sum "$patch_file" | cut -d ' ' -f 1)" == "${patch_checksums[$index]}" ]] ||
        fail "patch checksum mismatch: $patch_file"
done
[[ "$(printf '%s\n' "${patch_checksums[@]}" | sha256sum | cut -d ' ' -f 1)" == "$patch_digest" ]] ||
    fail 'ordered patch digest mismatch'
[[ -f "$module_lock" ]] || fail "missing module lock: $module_lock"
[[ "$(sha256sum "$module_lock" | cut -d ' ' -f 1)" == "$module_checksum" ]] ||
    fail 'module lock checksum mismatch'

stamp="$revision $archive_checksum $patch_digest $bazel_version $module_checksum $build_id"
if [[ ! -f "$source/.lazaret-materialization" ]]; then
    mkdir -p "$root/.lazaret/cache" "$root/.lazaret/vendor"
    if [[ ! -f "$archive" ]]; then
        partial="$archive.partial.$$"
        trap 'rm -f "$partial"' EXIT
        curl --fail --location --output "$partial" \
            "https://codeload.github.com/google/gvisor/tar.gz/$revision"
        [[ "$(sha256sum "$partial" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
            fail 'downloaded archive checksum mismatch'
        mv "$partial" "$archive"
        trap - EXIT
    fi
    [[ "$(sha256sum "$archive" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
        fail 'cached archive checksum mismatch'
    temporary="$(mktemp -d "$root/.lazaret/vendor/.gvisor-$build_id.XXXXXX")"
    trap 'rm -rf "$temporary"' EXIT
    tar -xzf "$archive" -C "$temporary"
    extracted="$temporary/gvisor-$revision"
    [[ -d "$extracted" ]] || fail 'archive has an unexpected root directory'
    for patch_file in "${patch_files[@]}"; do
        patch --directory="$extracted" --strip=1 --batch --fuzz=0 --forward <"$patch_file"
    done
    [[ "$(tr -d '\n' <"$extracted/.bazelversion")" == "$bazel_version" ]] ||
        fail 'Bazel version mismatch'
    install -m 0644 "$module_lock" "$extracted/MODULE.bazel.lock"
    printf '%s\n' "$stamp" >"$extracted/.lazaret-materialization"
    [[ ! -e "$source" ]] || fail 'immutable source destination already exists without a valid stamp'
    mv "$extracted" "$source"
    trap - EXIT
elif [[ "$(tr -d '\n' <"$source/.lazaret-materialization")" != "$stamp" ]]; then
    fail 'materialized source identity mismatch'
fi

if [[ "$mode" == test ]]; then
    make -C "$source" test \
        TARGETS='//pkg/sentry/fsimpl/gofer:gofer_test //runsc/fsgofer:lisafs_test //test/syscalls:socket_ip_tcp_generic_loopback_test_native //test/syscalls:socket_ip_tcp_generic_loopback_test_runsc_systrap_hostnet'
fi
if [[ "$mode" != source ]]; then
    make -C "$source" build TARGETS=//runsc:runsc
    built="$source/bazel-bin/runsc/runsc_/runsc"
    [[ -x "$built" ]] || fail 'canonical build did not produce runsc'
    version_output="$($built --version 2>&1)"
    [[ "$version_output" == $'runsc version 0.0.0\nspec: 1.2.1' ]] ||
        fail 'built runsc reports an unexpected version'
    mkdir -p "$root/.lazaret/bin"
    if [[ ! -e "$binary" ]]; then
        temporary_binary="$root/.lazaret/bin/.lazaret-runsc-$build_id.$$"
        trap 'rm -f "$temporary_binary"' EXIT
        install -m 0755 "$built" "$temporary_binary"
        mv "$temporary_binary" "$binary"
        trap - EXIT
    fi
    [[ -x "$binary" ]] || fail 'materialized runsc is not executable'
    sha256sum "$binary" >"$binary.sha256"
    printf '%s\n' "$binary"
fi