#!/usr/bin/env bash

set -Eeuo pipefail
export LANG=C
umask 077

EXPECTED_HOSTNAME="sqjcDB01"
EXPECTED_IPV4="10.2.208.106"
EXPECTED_OS="openEuler release 24.03 (LTS-SP1)"
EXPECTED_ARCH="x86_64"
BACKUP_ROOT="/var/backups/zhct-q060"
PACKAGE_ROOT="/opt/zhct-deploy/packages"
RPM_ROOT="${PACKAGE_ROOT}/rpms"
STAGE="${PACKAGE_ROOT}/.q060-rpm-stage"
EXPECTED_RPM_COUNT=83
OPEN_EULER_KEY="/etc/pki/rpm-gpg/RPM-GPG-KEY-openEuler"
OPEN_EULER_KEY_SHA256="006e79d37c10e74c24df6d07c4efc4176515cec009daa5ed493b06f5b6ef39c1"
OPEN_EULER_KEY_PACKAGE="gpg-pubkey-b675600b-63913a47"
MIN_FINAL_FREE_BYTES=$((9 * 1024 * 1024 * 1024))

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

require_command() {
  command -v "$1" >/dev/null 2>&1 || die "required command not found: $1"
}

reject_non_install_actions() {
  local log_file="$1"
  if grep -Eiq \
    '(^|[[:space:]])(Upgrading|Downgrading|Removing|Reinstalling|Obsoleting)(:|[[:space:]])|^[[:space:]]*(Upgrade|Downgrade|Remove|Reinstall|Obsolete)[[:space:]]+[1-9][0-9]*' \
    "${log_file}"; then
    die "DNF plan includes a non-install action: ${log_file}"
  fi
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ $# -eq 1 ]] || die "usage: $0 <q060-baseline-run-id>"
RUN_ID="$1"
[[ "${RUN_ID}" =~ ^[0-9]{8}T[0-9]{6}[+-][0-9]{4}$ ]] || die "invalid run id"
EVIDENCE_DIR="${BACKUP_ROOT}/${RUN_ID}"
SOURCE_RESULT="${EVIDENCE_DIR}/source-assets-result.env"
FRESH_ROOT="${EVIDENCE_DIR}/fresh-installroot"

for command_name in dnf rpm sha256sum findmnt awk grep sort find xargs du wc; do
  require_command "${command_name}"
done
[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
[[ "$(uname -m)" == "${EXPECTED_ARCH}" ]] || die "architecture mismatch"
[[ "$(tr -d '\r' </etc/openEuler-release)" == "${EXPECTED_OS}" ]] || die "OS mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"
[[ -s "${SOURCE_RESULT}" ]] || die "source asset result is missing"
grep -Fxq 'source_asset_download=PASS' "${SOURCE_RESULT}" || \
  die "source asset gate is not PASS"
grep -Fxq 'install_execution=NOT_PERFORMED' "${SOURCE_RESULT}" || \
  die "source asset phase records an installation"
[[ -d "${STAGE}" ]] || die "preserved RPM stage is missing"
[[ ! -e "${RPM_ROOT}" ]] || die "final RPM closure already exists"
[[ -d "${FRESH_ROOT}" ]] || die "preserved fresh installroot is missing"
[[ -z "$(find "${FRESH_ROOT}" -mindepth 1 -print -quit)" ]] || \
  die "preserved fresh installroot is not empty"
[[ ! -e "${EVIDENCE_DIR}/rpm-closure-result.env" ]] || \
  die "RPM closure result already exists"
for output in \
  v2-rpm-signatures.txt v2-rpm-nevra.tsv v2-rpm-requires.txt \
  v2-current-host-missing-rpms.txt v2-dnf-current-host-assumeno.log \
  v2-dnf-fresh-installroot-assumeno.log v2-rpm-sha256-check.txt; do
  [[ ! -e "${EVIDENCE_DIR}/${output}" ]] || die "V2 evidence already exists: ${output}"
done
[[ "$(sha256sum "${OPEN_EULER_KEY}" | awk '{print $1}')" == \
  "${OPEN_EULER_KEY_SHA256}" ]] || die "openEuler key SHA256 mismatch"
rpm -q --quiet "${OPEN_EULER_KEY_PACKAGE}" || die "pinned openEuler key is not imported"
[[ "$(rpm -qa 'gpg-pubkey*' | wc -l)" -eq 1 ]] || \
  die "RPMDB does not contain exactly one public key"

mapfile -d '' closure_rpms < <(
  find "${STAGE}" -maxdepth 1 -type f -name '*.rpm' -print0 | sort -z
)
RPM_COUNT="${#closure_rpms[@]}"
[[ "${RPM_COUNT}" -eq "${EXPECTED_RPM_COUNT}" ]] || \
  die "preserved RPM count mismatch: ${RPM_COUNT}"

printf '%s\0' "${closure_rpms[@]}" |
  xargs -0 -r rpm --define '_pkgverify_level signature' -K \
  >"${EVIDENCE_DIR}/v2-rpm-signatures.txt" 2>&1
[[ "$(grep -Eic 'digests[[:space:]]+signatures[[:space:]]+OK$' \
  "${EVIDENCE_DIR}/v2-rpm-signatures.txt")" -eq "${RPM_COUNT}" ]] || \
  die "not every preserved RPM has a trusted signature"
! grep -Eiq 'BAD|NOT OK|NOKEY|NOTTRUSTED' \
  "${EVIDENCE_DIR}/v2-rpm-signatures.txt" || \
  die "a preserved RPM signature is not trusted"

printf '%s\0' "${closure_rpms[@]}" |
  xargs -0 -r rpm -qp \
  --qf '%{NAME}\t%{EPOCHNUM}:%{VERSION}-%{RELEASE}\t%{ARCH}\t%{SIZE}\t%{VENDOR}\n' \
  2>/dev/null | sort -u >"${EVIDENCE_DIR}/v2-rpm-nevra.tsv"
[[ "$(wc -l <"${EVIDENCE_DIR}/v2-rpm-nevra.tsv")" -eq "${RPM_COUNT}" ]] || \
  die "RPM NEVRA row count mismatch"
awk -F'\t' \
  '{key=$1 FS $3; count[key]++} END {for (key in count) if (count[key] > 1) exit 1}' \
  "${EVIDENCE_DIR}/v2-rpm-nevra.tsv" || \
  die "multiple RPM versions exist for one name/arch"
for rpm_file in "${closure_rpms[@]}"; do
  printf '### %s\n' "$(basename "${rpm_file}")"
  rpm -qpR "${rpm_file}" | sort -u
done >"${EVIDENCE_DIR}/v2-rpm-requires.txt"

current_host_rpms=()
: >"${EVIDENCE_DIR}/v2-current-host-missing-rpms.txt"
for rpm_file in "${closure_rpms[@]}"; do
  package_name="$(rpm -qp --qf '%{NAME}' "${rpm_file}")"
  if ! rpm -q --quiet "${package_name}"; then
    current_host_rpms+=("${rpm_file}")
    basename "${rpm_file}" >>"${EVIDENCE_DIR}/v2-current-host-missing-rpms.txt"
  fi
done
if ((${#current_host_rpms[@]} > 0)); then
  set +e
  dnf --disablerepo='*' \
    --setopt=strict=True \
    --setopt=install_weak_deps=False \
    --setopt=localpkg_gpgcheck=True \
    --assumeno install "${current_host_rpms[@]}" \
    >"${EVIDENCE_DIR}/v2-dnf-current-host-assumeno.log" 2>&1
  HOST_RC=$?
  set -e
  [[ "${HOST_RC}" -eq 1 || "${HOST_RC}" -eq 0 ]] || \
    die "unexpected current-host DNF exit code: ${HOST_RC}"
else
  printf 'NO_MISSING_RPMS\n' >"${EVIDENCE_DIR}/v2-dnf-current-host-assumeno.log"
fi
! grep -Eiq 'nothing provides|conflicting requests|transaction test error|protected packages' \
  "${EVIDENCE_DIR}/v2-dnf-current-host-assumeno.log" || \
  die "missing-only current-host plan has an unresolved dependency or conflict"
reject_non_install_actions "${EVIDENCE_DIR}/v2-dnf-current-host-assumeno.log"

set +e
dnf --installroot="${FRESH_ROOT}" \
  --releasever=24.03_LTS_SP1 \
  --disablerepo='*' \
  --setopt=strict=True \
  --setopt=install_weak_deps=False \
  --setopt=keepcache=False \
  --nogpgcheck \
  --assumeno install "${closure_rpms[@]}" \
  >"${EVIDENCE_DIR}/v2-dnf-fresh-installroot-assumeno.log" 2>&1
FRESH_RC=$?
set -e
[[ "${FRESH_RC}" -eq 1 ]] || die "unexpected fresh-installroot DNF exit code: ${FRESH_RC}"
grep -Fq 'Transaction Summary' \
  "${EVIDENCE_DIR}/v2-dnf-fresh-installroot-assumeno.log" || \
  die "fresh installroot did not reach a transaction summary"
! grep -Eiq 'nothing provides|conflicting requests|transaction test error|protected packages' \
  "${EVIDENCE_DIR}/v2-dnf-fresh-installroot-assumeno.log" || \
  die "fresh-install closure is incomplete"
reject_non_install_actions "${EVIDENCE_DIR}/v2-dnf-fresh-installroot-assumeno.log"
[[ "${FRESH_ROOT}" == "${BACKUP_ROOT}/${RUN_ID}/fresh-installroot" ]] || \
  die "fresh installroot cleanup path mismatch"
find "${FRESH_ROOT}" -mindepth 1 -delete
rmdir "${FRESH_ROOT}"

mv "${STAGE}" "${RPM_ROOT}"
(
  cd "${PACKAGE_ROOT}"
  find rpms -maxdepth 1 -type f -name '*.rpm' -print0 | sort -z |
    xargs -0 sha256sum
) >"${PACKAGE_ROOT}/rpms.sha256"
chmod 0640 "${PACKAGE_ROOT}/rpms.sha256"
chmod -R go-rwx "${RPM_ROOT}"
(
  cd "${PACKAGE_ROOT}"
  sha256sum -c rpms.sha256
) >"${EVIDENCE_DIR}/v2-rpm-sha256-check.txt"

AVAILABLE_AFTER="$(findmnt -bn -o AVAIL /)"
[[ "${AVAILABLE_AFTER}" -ge "${MIN_FINAL_FREE_BYTES}" ]] || \
  die "root free space fell below 9 GiB after closure recovery"
RPM_MANIFEST_SHA256="$(sha256sum "${PACKAGE_ROOT}/rpms.sha256" | awk '{print $1}')"
{
  printf 'captured_at=%s\n' "$(date --iso-8601=seconds)"
  printf 'rpm_count=%s\n' "${RPM_COUNT}"
  printf 'current_host_missing_rpm_count=%s\n' "${#current_host_rpms[@]}"
  printf 'rpm_bytes=%s\n' "$(du -sb "${RPM_ROOT}" | awk '{print $1}')"
  printf 'rpm_manifest_sha256=%s\n' "${RPM_MANIFEST_SHA256}"
  printf 'rpm_signature_check=PASS\n'
  printf 'rpm_signing_key=%s\n' "${OPEN_EULER_KEY_PACKAGE}"
  printf 'current_host_transaction=MISSING_NAMES_INSTALL_ONLY_OR_NOTHING_TO_DO\n'
  printf 'fresh_installroot_dependency_resolution=PASS_ASSUMENO\n'
  printf 'installed_package_upgrade=NOT_PLANNED\n'
  printf 'installed_package_pruning=NOT_PERFORMED\n'
  printf 'install_execution=NOT_PERFORMED\n'
  printf 'post_clone_execution=NOT_PERFORMED\n'
} >"${EVIDENCE_DIR}/rpm-closure-result.env"
chmod 0600 "${EVIDENCE_DIR}"/v2-dnf-* "${EVIDENCE_DIR}"/v2-rpm-* \
  "${EVIDENCE_DIR}/v2-current-host-missing-rpms.txt" \
  "${EVIDENCE_DIR}/rpm-closure-result.env"

printf 'Q060_FRESH_INSTALL_CLOSURE_V2_OK\n'
cat "${EVIDENCE_DIR}/rpm-closure-result.env"