#!/usr/bin/env bash
set -Eeuo pipefail

[[ $# == 2 ]] || { echo 'usage: install-jd-guanghu-master-candidate.sh <supervisor-source> <source-commit>' >&2; exit 64; }

source_file=$(readlink -f "$1")
source_commit=$2
readonly node_id=JD-FD-PRIMARY
readonly instance_id=f3d4b730-7f02-452f-975b-7091a4800431
readonly root_uuid=9e4550a0-452b-4f28-b5a5-d5364aa450f6
readonly linux_entry=gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
readonly master_entry=guanghu-jd-master-20260816
readonly install_path=/usr/local/libexec/guanghu/guanghu-master-init
readonly grub_source=/etc/grub.d/42_guanghu_master
readonly receipt_root=/guanghu/recovery/JD-FD-PRIMARY-master-20260816

[[ $source_commit =~ ^[0-9a-f]{40}$ ]]
[[ -f $source_file && ! -L $source_file ]]
bash -n "$source_file"
[[ $(tr A-F a-f </sys/class/dmi/id/product_uuid | tr -d '\r\n') == "$instance_id" ]]
[[ $(findmnt -n -o SOURCE /) == /dev/vda1 ]]
[[ $(grub-probe --target=fs_uuid /) == "$root_uuid" ]]
grep -Fq "$linux_entry" /boot/grub/grub.cfg
grep -Eq "^GRUB_DEFAULT=${linux_entry}$" /etc/default/grub
[[ -f /boot/vmlinuz-5.15.0-60-generic && -f /boot/initrd.img-5.15.0-60-generic ]]

mkdir -p "$(dirname "$install_path")" "$receipt_root/rollback"
chmod 0700 "$receipt_root" "$receipt_root/rollback"
cp -a /etc/default/grub "$receipt_root/rollback/grub.default.before"
[[ ! -e $grub_source ]] || cp -a "$grub_source" "$receipt_root/rollback/42_guanghu_master.before"
install -o root -g root -m 0755 "$source_file" "$install_path"

cat >"$grub_source" <<EOF
#!/bin/sh
exec tail -n +3 \$0
menuentry 'Guanghu OS master · JD repository bridge' --class guanghu --class os --id '${master_entry}' {
    recordfail
    insmod gzio
    insmod part_msdos
    insmod ext2
    search --no-floppy --fs-uuid --set=root ${root_uuid}
    linux /boot/vmlinuz-5.15.0-60-generic root=UUID=${root_uuid} ro net.ifnames=0 biosdevname=0 selinux=0 console=tty0 console=ttyS0,115200n8 guanghu.master=1 init=${install_path} panic=10
    initrd /boot/initrd.img-5.15.0-60-generic
}
EOF
chmod 0755 "$grub_source"
update-grub >/dev/null

grep -Fq "'${master_entry}'" /boot/grub/grub.cfg
grep -Fq "guanghu.master=1 init=${install_path}" /boot/grub/grub.cfg
grep -Eq "^GRUB_DEFAULT=${linux_entry}$" /etc/default/grub
"$install_path" preflight

installed_sha=$(sha256sum "$install_path" | awk '{print $1}')
source_sha=$(sha256sum "$source_file" | awk '{print $1}')
[[ $installed_sha == "$source_sha" ]]
boot_id=$(cat /proc/sys/kernel/random/boot_id)
cat >"$receipt_root/CANDIDATE-INSTALL-RECEIPT.hldp" <<EOF
[hldp]
schema=guanghu.jd-master-candidate-install/v1
node_id=${node_id}
instance_id=${instance_id}
source_commit=${source_commit}
source_sha256=${source_sha}
installed_sha256=${installed_sha}
master_entry=${master_entry}
unattended_default=${linux_entry}
boot_id=${boot_id}
control_candidate=GUANGHU_OS_MASTER
linux_kernel_role=HARDWARE_COMPATIBILITY_SUBSTRATE
full_linux_userspace=DORMANT_IN_CANDIDATE
linux_repository_bridge=BOUNDED_SUBCONTROL
linux_rescue=PRESERVED
result=PASS_100
EOF
chmod 0600 "$receipt_root/CANDIDATE-INSTALL-RECEIPT.hldp"
sha256sum "$receipt_root/CANDIDATE-INSTALL-RECEIPT.hldp" >"$receipt_root/CANDIDATE-INSTALL-RECEIPT.hldp.sha256"
sync
printf 'GUANGHU_MASTER_CANDIDATE_INSTALLED entry=%s sha256=%s default=%s\n' "$master_entry" "$installed_sha" "$linux_entry"