# shellcheck shell=bash
# The deploy smoke test's module package release pair (ADR 0049).
#
# A package archive and its `.sha256` are one logical release: they travel together, and the
# verifier reads both. This turns one build's output into exactly that pair, in a directory any user
# can traverse, because the verifier runs as the image's unprivileged user.
#
# BuildKit's local exporter creates its output directory with mode 0700, owned by whoever ran the
# build. On a workstation that is usually uid 1000, which is also the image's `node` user, so the
# verifier happened to read it; in CI the build runs as root, and the verifier could read neither file.
# Nothing here depends on who built the package.

# module_package_release <build output directory> <new release directory>
#
# Checks the build output holds exactly one archive and its digest and nothing else, and that the
# digest line names that archive. Then creates the release directory, which must not exist yet (so an
# earlier run's files can never be mixed in), mode 0755, and copies both files into it, mode 0644.
# Prints the archive's file name. Fails, creating nothing, on any deviation.
module_package_release() {
  local output="$1" release="$2" archives=() archive digest_line digest named entries

  shopt -s nullglob
  archives=("$output"/*.tar.gz)
  shopt -u nullglob
  if ((${#archives[@]} != 1)); then
    echo "module_package_release: the build output must hold exactly one package archive." >&2
    return 1
  fi
  archive="$(basename -- "${archives[0]}")"
  if [[ ! -f "$output/$archive.sha256" ]]; then
    echo "module_package_release: the package's .sha256 is missing." >&2
    return 1
  fi
  entries="$(find "$output" -mindepth 1 -maxdepth 1 | wc -l)"
  if ((entries != 2)); then
    echo "module_package_release: the build output holds more than the archive and its digest." >&2
    return 1
  fi
  digest_line="$(<"$output/$archive.sha256")"
  digest="${digest_line%%  *}"
  named="${digest_line#*  }"
  if [[ ! "$digest" =~ ^[0-9a-f]{64}$ || "$named" != "$archive" ]]; then
    echo "module_package_release: the .sha256 line does not name this archive." >&2
    return 1
  fi

  mkdir -m 755 -- "$release" || return 1
  if ! install -m 0644 -- "$output/$archive" "$output/$archive.sha256" "$release/"; then
    rm -rf -- "$release"
    return 1
  fi
  printf '%s\n' "$archive"
}