#!/usr/bin/env bash
set -euo pipefail

[[ $# -eq 2 ]] || {
  echo "usage: clear-jd-native-probe-proof.sh <world-root> <recovery-root>" >&2
  exit 64
}
[[ ${EUID} -eq 0 ]] || exit 77

world_root=$(readlink -f "$1")
recovery_root=$(readlink -f "$2")
grep -q '^node_id: JD-FD-PRIMARY$' "${world_root}/CURRENT.hldp"
grep -q '^status: FAIL_0$' "${recovery_root}/RETURN-RECEIPT.hldp"
grep -q '^  proof_lba: 134$' "${recovery_root}/RETURN-RECEIPT.hldp"
/guanghu/bin/ghctl authorize "${world_root}" \
  write_bootloader_and_system_partitions >/dev/null

proof=${recovery_root}/lba134.native-proof.bin
expected_sha=$(awk '/^  proof_sha256:/ {print $2}' \
  "${recovery_root}/RETURN-RECEIPT.hldp")
[[ ${expected_sha} =~ ^[0-9a-f]{64}$ ]]
[[ $(sha256sum "${proof}" | awk '{print $1}') == "${expected_sha}" ]]
[[ $(dd if=/dev/vda bs=512 skip=134 count=1 status=none | sha256sum |
  awk '{print $1}') == "${expected_sha}" ]]

dd if=/dev/zero of=/dev/vda bs=512 seek=134 count=1 conv=notrunc,fsync \
  status=none
zero_sha=$(head -c 512 /dev/zero | sha256sum | awk '{print $1}')
readback_sha=$(dd if=/dev/vda bs=512 skip=134 count=1 status=none |
  sha256sum | awk '{print $1}')
[[ ${readback_sha} == "${zero_sha}" ]]

observed_at=$(date --iso-8601=seconds)
cat >"${recovery_root}/PROOF-CLEAR-RECEIPT.hldp" <<EOF
schema: guanghu.jd-native-probe-proof-clear/v1
receipt_id: GH-OS-JD-FD-PRIMARY-001-PROBE-PROOF-CLEAR
status: PASS_100
observed_at: ${observed_at}
node_id: JD-FD-PRIMARY
proof:
  lba: 134
  sealed_sha256: ${expected_sha}
  zero_readback_sha256: ${readback_sha}
reason: SEALED_FAIL_0_CONSUMED_BEFORE_EXACT_HARDWARE_ADAPTER_RETRY
EOF
chmod 0400 "${recovery_root}/PROOF-CLEAR-RECEIPT.hldp"
cat "${recovery_root}/PROOF-CLEAR-RECEIPT.hldp"