#!/usr/bin/env bash
set -euo pipefail

readonly HLCC_VERSION="16.0.1"
readonly HLCC_ROOT="/var/lib/guanghu/code-channel/candidates/hlcc-v${HLCC_VERSION}"
readonly HLCC_SOURCE_ARCHIVE="/var/lib/guanghu/code-channel/offline-source/hlcc-v${HLCC_VERSION}"
readonly HLCC_RELEASE_KEY="EB114F5E6C0DC2BCDD183550A4B61A2DC5923710"
readonly HLCC_PACKAGE_SOURCE="${1:-}"
readonly HLCC_CONFIG_SOURCE="${2:-}"
readonly HLCC_BINARY_NAME="forgejo-${HLCC_VERSION}-linux-amd64"
readonly HLCC_BINARY_SOURCE="${HLCC_PACKAGE_SOURCE}/${HLCC_BINARY_NAME}"
readonly HLCC_SIGNATURE_SOURCE="${HLCC_BINARY_SOURCE}.asc"
readonly HLCC_PUBLIC_KEY_SOURCE="${HLCC_PACKAGE_SOURCE}/forgejo-release-key.asc"
readonly HLCC_MANIFEST_SOURCE="${HLCC_PACKAGE_SOURCE}/MANIFEST.sha256"
readonly HLCC_UPSTREAM_BUNDLE_SOURCE="${HLCC_PACKAGE_SOURCE}/forgejo-upstream-all.bundle"
readonly HLCC_PRODUCT_BUNDLE_SOURCE="${HLCC_PACKAGE_SOURCE}/guanghu-code-channel.bundle"

if [[ "$(id -un)" != "guanghu" ]]; then
  echo "Refusing to install a domestic isolated candidate as any user other than guanghu." >&2
  exit 2
fi

if [[ \
  -z "${HLCC_PACKAGE_SOURCE}" || ! -d "${HLCC_PACKAGE_SOURCE}" || \
  ! -f "${HLCC_BINARY_SOURCE}" || \
  ! -f "${HLCC_SIGNATURE_SOURCE}" || \
  ! -f "${HLCC_PUBLIC_KEY_SOURCE}" || \
  ! -f "${HLCC_MANIFEST_SOURCE}" || \
  ! -f "${HLCC_UPSTREAM_BUNDLE_SOURCE}" || \
  ! -f "${HLCC_PRODUCT_BUNDLE_SOURCE}" || \
  -z "${HLCC_CONFIG_SOURCE}" || ! -f "${HLCC_CONFIG_SOURCE}" \
 ]]; then
  echo "Usage: $0 /absolute/path/to/offline-package candidate-app.<target>.ini" >&2
  exit 2
fi

for command_name in gpg sha256sum git; do
  if ! command -v "${command_name}" >/dev/null 2>&1; then
    echo "Missing required command: ${command_name}" >&2
    exit 3
  fi
done

umask 077
mkdir -p \
  "${HLCC_ROOT}/bin" \
  "${HLCC_ROOT}/config" \
  "${HLCC_ROOT}/data/repositories" \
  "${HLCC_ROOT}/logs" \
  "${HLCC_ROOT}/tmp" \
  "${HLCC_SOURCE_ARCHIVE}"

readonly gpg_home="${HLCC_ROOT}/tmp/gpg"
mkdir -p "${gpg_home}"
chmod 700 "${gpg_home}"

(
  cd "${HLCC_PACKAGE_SOURCE}"
  sha256sum --check MANIFEST.sha256
)

GNUPGHOME="${gpg_home}" gpg --batch --import "${HLCC_PUBLIC_KEY_SOURCE}"

if ! GNUPGHOME="${gpg_home}" gpg \
  --batch \
  --with-colons \
  --fingerprint "${HLCC_RELEASE_KEY}" \
  | grep -Fq "fpr:::::::::${HLCC_RELEASE_KEY}:"; then
  echo "Forgejo release key fingerprint mismatch." >&2
  exit 4
fi

GNUPGHOME="${gpg_home}" gpg \
  --batch \
  --verify "${HLCC_SIGNATURE_SOURCE}" "${HLCC_BINARY_SOURCE}"

install -m 0755 "${HLCC_BINARY_SOURCE}" "${HLCC_ROOT}/bin/hlcc"
install -m 0600 "${HLCC_CONFIG_SOURCE}" "${HLCC_ROOT}/config/app.ini"
install -m 0600 "${HLCC_MANIFEST_SOURCE}" "${HLCC_SOURCE_ARCHIVE}/MANIFEST.sha256"
install -m 0755 "${HLCC_BINARY_SOURCE}" "${HLCC_SOURCE_ARCHIVE}/${HLCC_BINARY_NAME}"
install -m 0600 "${HLCC_UPSTREAM_BUNDLE_SOURCE}" "${HLCC_SOURCE_ARCHIVE}/forgejo-upstream-all.bundle"
install -m 0600 "${HLCC_PRODUCT_BUNDLE_SOURCE}" "${HLCC_SOURCE_ARCHIVE}/guanghu-code-channel.bundle"
install -m 0600 "${HLCC_PUBLIC_KEY_SOURCE}" "${HLCC_SOURCE_ARCHIVE}/forgejo-release-key.asc"
install -m 0600 "${HLCC_SIGNATURE_SOURCE}" "${HLCC_SOURCE_ARCHIVE}/${HLCC_BINARY_NAME}.asc"
install -m 0600 "${HLCC_CONFIG_SOURCE}" "${HLCC_SOURCE_ARCHIVE}/candidate-app.ini"
(
  cd "${HLCC_SOURCE_ARCHIVE}"
  sha256sum --check MANIFEST.sha256
)
sha256sum "${HLCC_ROOT}/bin/hlcc" > "${HLCC_ROOT}/RELEASE.sha256"

"${HLCC_ROOT}/bin/hlcc" --version
echo "HLCC isolated candidate installed at ${HLCC_ROOT}"
echo "Offline source and release material retained at ${HLCC_SOURCE_ARCHIVE}"
echo "No service was started and no automatic update job was installed."