#!/usr/bin/env bash
set -euo pipefail

[[ $# -eq 2 ]] || {
  echo "usage: arm-jd-native-resident-once.sh <world-root> <recovery-root>" >&2
  exit 64
}
[[ ${EUID} -eq 0 ]] || exit 77

world_root=$(readlink -f "$1")
recovery_root=$(readlink -f "$2")
grep -q '^status: VERIFIED_NOT_ARMED$' \
  "${recovery_root}/PREPARE-RECEIPT.hldp"
/guanghu/bin/ghctl authorize "${world_root}" \
  reboot_and_recover_jd_fd_primary >/dev/null
grub-editenv /boot/grub/grubenv unset initrdfail prev_entry next_entry
grub-reboot guanghu-jd-native-once
grep -q '^next_entry=guanghu-jd-native-once$' \
  < <(grub-editenv /boot/grub/grubenv list)

observed_at=$(date --iso-8601=seconds)
cat >"${recovery_root}/ARM-RECEIPT.hldp" <<EOF
schema: guanghu.jd-native-resident-arm/v1
receipt_id: GH-OS-JD-FD-PRIMARY-001-RESIDENT-ARM
status: ARMED_FOR_ONE_BOOT
observed_at: ${observed_at}
node_id: JD-FD-PRIMARY
entry: guanghu-jd-native-once
recovery: GHNRP_LBA_139_140
EOF
chmod 0400 "${recovery_root}/ARM-RECEIPT.hldp"
sync
systemctl reboot