#!/usr/bin/env bash

set -Eeuo pipefail
export LANG=C
umask 077

EXPECTED_HOSTNAME="sqjcDB01"
EXPECTED_IPV4="10.2.208.106"
BACKUP_ROOT="/var/backups/zhct-q060"
BUNDLE_ROOT="/opt/zhct-deploy"
PACKAGE_ROOT="${BUNDLE_ROOT}/packages"
ROLE_MANIFEST_ROOT="${BUNDLE_ROOT}/roles/mysql/manifests"
MYSQL56="mysql-5.6.51-linux-glibc2.12-x86_64.tar.gz"
MYSQL80="mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz"
LNMP="lnmp2.2-from-git-20260706.tar.gz"
LNMP_SHA256="9cdc130f859bfca6cbd138950128fda358b88fb1ebadad4f937ebc4560fe990b"

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

asset_sha() {
  local artifact="$1"
  awk -F'\t' -v wanted="${artifact}" \
    'NR > 1 && $1 == wanted && $5 == "LOCKED" {print $3; exit}' \
    "${EVIDENCE_DIR}/mysql-source-assets.tsv"
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ $# -eq 1 ]] || die "usage: $0 <q060-baseline-run-id>"
RUN_ID="$1"
EVIDENCE_DIR="${BACKUP_ROOT}/${RUN_ID}"
[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"

for required in \
  "${EVIDENCE_DIR}/source-assets-result.env" \
  "${EVIDENCE_DIR}/mysql-source-assets.tsv" \
  "${EVIDENCE_DIR}/rpm-closure-result.env" \
  "${EVIDENCE_DIR}/locked-assets-verification-result.env" \
  "${PACKAGE_ROOT}/${LNMP}" \
  "${PACKAGE_ROOT}/${MYSQL56}" \
  "${PACKAGE_ROOT}/${MYSQL80}" \
  "${PACKAGE_ROOT}/rpms.sha256"; do
  [[ -s "${required}" ]] || die "required verified input is missing: ${required}"
done
grep -Fxq 'source_asset_download=PASS' "${EVIDENCE_DIR}/source-assets-result.env" ||
  die "source asset gate is not PASS"
grep -Fxq 'fresh_installroot_dependency_resolution=PASS_ASSUMENO' \
  "${EVIDENCE_DIR}/rpm-closure-result.env" || die "RPM closure gate is not PASS"
grep -Fxq 'gpg_recheck=PASS' "${EVIDENCE_DIR}/locked-assets-verification-result.env" ||
  die "GPG recheck gate is not PASS"
grep -Fxq 'mysql56_runtime_ldd=PASS' \
  "${EVIDENCE_DIR}/locked-assets-verification-result.env" || die "MySQL 5.6 ldd gate is not PASS"
grep -Fxq 'mysql80_runtime_ldd=PASS' \
  "${EVIDENCE_DIR}/locked-assets-verification-result.env" || die "MySQL 8.0 ldd gate is not PASS"

MYSQL56_SHA256="$(asset_sha "${MYSQL56}")"
MYSQL80_SHA256="$(asset_sha "${MYSQL80}")"
RPM_MANIFEST_SHA256="$(sha256sum "${PACKAGE_ROOT}/rpms.sha256" | awk '{print $1}')"
[[ "${MYSQL56_SHA256}" =~ ^[0-9a-f]{64}$ ]] || die "invalid MySQL 5.6 SHA256"
[[ "${MYSQL80_SHA256}" =~ ^[0-9a-f]{64}$ ]] || die "invalid MySQL 8.0 SHA256"
[[ "$(sha256sum "${PACKAGE_ROOT}/${LNMP}" | awk '{print $1}')" == "${LNMP_SHA256}" ]] ||
  die "LNMP reference SHA256 mismatch"
[[ "$(sha256sum "${PACKAGE_ROOT}/${MYSQL56}" | awk '{print $1}')" == \
  "${MYSQL56_SHA256}" ]] || die "MySQL 5.6 SHA256 mismatch"
[[ "$(sha256sum "${PACKAGE_ROOT}/${MYSQL80}" | awk '{print $1}')" == \
  "${MYSQL80_SHA256}" ]] || die "MySQL 8.0 SHA256 mismatch"
(
  cd "${PACKAGE_ROOT}"
  sha256sum -c rpms.sha256
) >"${EVIDENCE_DIR}/finalize-rpm-sha256-check.txt"

BACKUP_DIR="${EVIDENCE_DIR}/manifest-before-finalize"
install -d -m 0700 "${BACKUP_DIR}"
cp -a "${ROLE_MANIFEST_ROOT}/asset-digests.tsv" \
  "${ROLE_MANIFEST_ROOT}/packages.sha256" \
  "${ROLE_MANIFEST_ROOT}/repo-snapshot.txt" \
  "${BACKUP_DIR}/"

{
  printf 'artifact\tsha256\tstatus\tsource\n'
  printf '%s\t%s\tLOCKED\tQ-022 local Binzhou reference\n' "${LNMP}" "${LNMP_SHA256}"
  printf '%s\t%s\tLOCKED\tQ-060 Oracle GPG and runtime verified\n' \
    "${MYSQL56}" "${MYSQL56_SHA256}"
  printf '%s\t%s\tLOCKED\tQ-060 Oracle GPG and runtime verified\n' \
    "${MYSQL80}" "${MYSQL80_SHA256}"
  printf 'rpms.sha256\t%s\tLOCKED\tQ-060 signed fresh-install openEuler SP1 closure\n' \
    "${RPM_MANIFEST_SHA256}"
} >"${ROLE_MANIFEST_ROOT}/asset-digests.tsv"
{
  printf '%s  packages/%s\n' "${LNMP_SHA256}" "${LNMP}"
  printf '%s  packages/%s\n' "${MYSQL56_SHA256}" "${MYSQL56}"
  printf '%s  packages/%s\n' "${MYSQL80_SHA256}" "${MYSQL80}"
  printf '%s  packages/rpms.sha256\n' "${RPM_MANIFEST_SHA256}"
} >"${ROLE_MANIFEST_ROOT}/packages.sha256"
{
  printf 'status=LOCKED_Q060\n'
  printf 'run_id=%s\n' "${RUN_ID}"
  printf 'rpm_manifest_sha256=%s\n' "${RPM_MANIFEST_SHA256}"
  printf 'rpm_signature_check=PASS\n'
  printf 'fresh_installroot_dependency_resolution=PASS_ASSUMENO\n'
  printf 'mysql_gpg_recheck=PASS\n'
  printf 'mysql_runtime_ldd=PASS\n'
  printf 'install_execution=NOT_PERFORMED\n'
} >"${ROLE_MANIFEST_ROOT}/repo-snapshot.txt"
chmod 0640 "${ROLE_MANIFEST_ROOT}/asset-digests.tsv" \
  "${ROLE_MANIFEST_ROOT}/packages.sha256" "${ROLE_MANIFEST_ROOT}/repo-snapshot.txt"

printf 'Q060_MANIFESTS_LOCKED_OK\n'
sha256sum "${ROLE_MANIFEST_ROOT}/asset-digests.tsv" \
  "${ROLE_MANIFEST_ROOT}/packages.sha256" "${ROLE_MANIFEST_ROOT}/repo-snapshot.txt"