#!/usr/bin/env bash

set -Eeuo pipefail

EXPECTED_HOSTNAME="sqjcnginx01"
EXPECTED_IPV4="10.2.203.102"
EXPECTED_SOURCE_COMMIT="47584918681b8aad36fee3c9eade5cd919c702ab"
EXPECTED_FRAMEWORK_SHA256="f74941f6328c752eeefb5fe082c4366dfed5c91ecad36d31ba7e11b7d2cac2d5"
EXPECTED_RPM_MANIFEST_SHA256="0ef1b62af801d782e8331b608b4b0580e0721a7553e913ab17686d4dc32dee3d"
EXPECTED_PERCONA_FINGERPRINT="4D1B B29D 63D9 8E42 2B21 13B1 9334 A25F 8507 EFA5"
BUNDLE_ROOT="/opt/zhct-deploy"
PACKAGE_ROOT="${BUNDLE_ROOT}/packages"
EVIDENCE_DIR="/var/backups/zhct-q040/20260722T203557+0800"

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 | \
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"
[[ "$(tr -d '\r\n' <"${BUNDLE_ROOT}/.source-commit")" == "${EXPECTED_SOURCE_COMMIT}" ]] || \
  die "framework source commit mismatch"
[[ "$(tr -d '\r\n' <"${BUNDLE_ROOT}/.framework-bundle-sha256")" == "${EXPECTED_FRAMEWORK_SHA256}" ]] || \
  die "framework bundle SHA256 marker mismatch"
[[ "$(sha256sum "${PACKAGE_ROOT}/rpms.sha256" | awk '{print $1}')" == "${EXPECTED_RPM_MANIFEST_SHA256}" ]] || \
  die "RPM manifest SHA256 mismatch"
[[ $(wc -l <"${PACKAGE_ROOT}/rpms.sha256") -eq 18 ]] || die "RPM manifest does not contain 18 rows"

while IFS= read -r -d '' script; do
  bash -n "${script}"
done < <(find "${BUNDLE_ROOT}/common" "${BUNDLE_ROOT}/roles/nginx" -type f -name '*.sh' -print0 | sort -z)

(cd "${BUNDLE_ROOT}" && sha256sum -c roles/nginx/manifests/packages.sha256) \
  >"${EVIDENCE_DIR}/v8-nginx-packages-sha256-check.txt"
(cd "${PACKAGE_ROOT}" && sha256sum -c rpms.sha256) \
  >"${EVIDENCE_DIR}/v8-minimal-rpms-sha256-check.txt"

open_euler_signature_log="${EVIDENCE_DIR}/v8-openeuler-rpm-signatures.txt"
: >"${open_euler_signature_log}"
open_euler_rpm_count=0
while IFS= read -r -d '' rpm_file; do
  rpm -K "${rpm_file}" >>"${open_euler_signature_log}" 2>&1
  open_euler_rpm_count=$((open_euler_rpm_count + 1))
done < <(find "${PACKAGE_ROOT}/rpms" -maxdepth 1 -type f -name '*.rpm' \
  ! -name 'percona-orchestrator*.rpm' -print0 | sort -z)
[[ "${open_euler_rpm_count}" -eq 15 ]] || die "expected 15 openEuler RPMs"
[[ $(wc -l <"${open_euler_signature_log}") -eq "${open_euler_rpm_count}" ]] || \
  die "openEuler signature output count mismatch"
if grep -Eiq 'BAD|NOT OK|NOKEY|NOTTRUSTED' "${open_euler_signature_log}"; then
  die "openEuler signature verification failed"
fi

percona_signature_evidence="${EVIDENCE_DIR}/orchestrator-rpm-signature-verified.txt"
[[ $(grep -Eci '8507efa5:[[:space:]]+OK' "${percona_signature_evidence}") -eq 3 ]] || \
  die "expected three Percona signatures from key 8507efa5"
if grep -Eiq 'BAD|NOT OK|NOKEY|NOTTRUSTED' "${percona_signature_evidence}"; then
  die "Percona signature verification failed"
fi
normalized_percona_key=$(tr -s '[:space:]' ' ' <"${EVIDENCE_DIR}/percona-packaging-key.txt")
[[ "${normalized_percona_key}" == *"${EXPECTED_PERCONA_FINGERPRINT}"* ]] || \
  die "Percona key fingerprint mismatch"

orchestrator_evidence="${EVIDENCE_DIR}/v8-orchestrator-nevra-requires.txt"
: >"${orchestrator_evidence}"
for rpm_file in "${PACKAGE_ROOT}"/percona-orchestrator*.rpm; do
  printf 'FILE=%s\n' "$(basename "${rpm_file}")" >>"${orchestrator_evidence}"
  rpm --nodigest --nosignature -qp --qf 'NEVRA=%{NAME}-%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n' \
    "${rpm_file}" >>"${orchestrator_evidence}"
  rpm --nodigest --nosignature -qpR "${rpm_file}" >>"${orchestrator_evidence}"
done

"${BUNDLE_ROOT}/common/bin/role-action.sh" install \
  --role nginx \
  --bundle-root "${BUNDLE_ROOT}" \
  --dry-run \
  >"${EVIDENCE_DIR}/nginx-role-install-dry-run.log" 2>&1
grep -Fq 'install completed for role=nginx dry_run=1' \
  "${EVIDENCE_DIR}/nginx-role-install-dry-run.log" || die "role install dry-run did not complete"
if grep -Fq 'PENDING:' "${EVIDENCE_DIR}/nginx-role-install-dry-run.log"; then
  die "role install dry-run still contains a pending asset"
fi

evidence_files=(
  dnf-repolist-before-closure.txt
  yum-repo-files.sha256
  yum-repo-effective-lines.txt
  dnf-repomd-sha256.txt
  minimal-rpm-nevra.tsv
  minimal-rpm-sha256-absolute.txt
  minimal-openeuler-rpm-signatures.txt
  minimal-rpm-closure-result.env
  dnf-minimal-closure-assumeno.log
  percona-packaging-key.txt
  percona-packaging-key.sha256
  orchestrator-rpm-signature-verified.txt
  orchestrator-rpm-requires.txt
  v8-nginx-packages-sha256-check.txt
  v8-minimal-rpms-sha256-check.txt
  v8-openeuler-rpm-signatures.txt
  v8-orchestrator-nevra-requires.txt
  nginx-role-install-dry-run.log
)
for evidence_file in "${evidence_files[@]}"; do
  [[ -f "${EVIDENCE_DIR}/${evidence_file}" ]] || die "evidence file is missing: ${evidence_file}"
done
(
  cd "${EVIDENCE_DIR}"
  sha256sum "${evidence_files[@]}"
) >"${EVIDENCE_DIR}/q040-v8-evidence-index.sha256"
evidence_index_sha256=$(sha256sum "${EVIDENCE_DIR}/q040-v8-evidence-index.sha256" | awk '{print $1}')

{
  printf 'captured_at=%s\n' "$(date --iso-8601=seconds)"
  printf 'source_commit=%s\n' "${EXPECTED_SOURCE_COMMIT}"
  printf 'framework_bundle_sha256=%s\n' "${EXPECTED_FRAMEWORK_SHA256}"
  printf 'rpm_manifest_sha256=%s\n' "${EXPECTED_RPM_MANIFEST_SHA256}"
  printf 'rpm_count=18\n'
  printf 'openeuler_rpm_count=%s\n' "${open_euler_rpm_count}"
  printf 'percona_rpm_count=3\n'
  printf 'shell_syntax_check=PASS\n'
  printf 'locked_asset_check=PASS\n'
  printf 'nested_rpm_manifest_check=PASS\n'
  printf 'extra_or_missing_rpm_check=PASS\n'
  printf 'openeuler_signature_check=PASS\n'
  printf 'percona_signature_check=PASS\n'
  printf 'orchestrator_nevra_requires_check=PASS\n'
  printf 'role_install_dry_run=PASS\n'
  printf 'evidence_index_sha256=%s\n' "${evidence_index_sha256}"
  printf 'install_execution=NOT_PERFORMED\n'
} >"${EVIDENCE_DIR}/v8-result.env"

chmod 0600 "${EVIDENCE_DIR}"/v8-* \
  "${EVIDENCE_DIR}/q040-v8-evidence-index.sha256" \
  "${EVIDENCE_DIR}/nginx-role-install-dry-run.log"

printf 'Q040_V8_LOCKED_ASSETS_OK\n'
cat "${EVIDENCE_DIR}/v8-result.env"