#!/usr/bin/env bash

set -Eeuo pipefail
umask 077
export LANG=C

EXPECTED_HOSTNAME="sqjcDB01"
EXPECTED_IPV4="10.2.208.106"
EXPECTED_OS="openEuler release 24.03 (LTS-SP1)"
EXPECTED_ARCH="x86_64"
EXPECTED_Q063_RUN_ID="20260727T161309+0800"
EXPECTED_Q063_ARCHIVE_SHA256="28bda259b2858c25437c2fa14c19e275bd88e06a312a19fb11fdea917d1eb6cf"
EXPECTED_SEAL_WRAPPER_SHA256="45171865992b8d8bf94735a889b3f69eefe65707187cf3acb97683bbd69b9e02"
EXPECTED_POST_CLONE_WRAPPER_SHA256="ca5fa0a113739bcbe3ff51b2815bb50723cd8b1cf33dfb6d3f3f172caf2dabc6"
EXPECTED_ROLE_ACTION_SHA256="e3eae16aa5c87f43b56495fc71de378a947578cabe18b507e8fed01ac1f32025"
EXPECTED_RUNTIME_SHA256="4c06e4ad325de7241607b06d93c99c2f35f3422bfcbdbeeb43b530f2053f4bb6"
EXPECTED_MYSQL_HOOKS_SHA256="56d68209ab3dc5da3f4ab2c0b679329fc27892749de5b4f65ff9b72e1ccfd8fd"
EXPECTED_ROLE_ENV_SHA256="20f7c95907d4ba9ed393de854a47c424162cc3a1a0e6db04abba5cbcfef0ec99"
EXPECTED_UNITS_SHA256="157a7b2f62b40a163d61d367698519d7a919465d6c650c082582101afecf6ba0"
EXPECTED_NODES_SHA256="ba1048576a589845a643158da9fbe18cc21c17ab65d7fcc3dfb2c1797e50e8b1"

BUNDLE_ROOT="/opt/zhct-deploy"
SEAL_SCRIPT="${BUNDLE_ROOT}/common/scripts/seal-template.sh"
POST_CLONE_SCRIPT="${BUNDLE_ROOT}/common/scripts/post-clone.sh"
Q063_EVIDENCE="/var/backups/zhct-q063/${EXPECTED_Q063_RUN_ID}"
Q063_RESULT="${Q063_EVIDENCE}/result.env"
Q063_ARCHIVE="/root/sanquan-mysql01-q063-evidence-${EXPECTED_Q063_RUN_ID}.tar.gz"
EVIDENCE_ROOT="/var/backups/zhct-q064"
RUN_ID=${1:-}
MODE=${2:-}
EVIDENCE_DIR="${EVIDENCE_ROOT}/${RUN_ID}"
FINAL_RESULT="${EVIDENCE_DIR}/result.env"
FINAL_INDEX="${EVIDENCE_DIR}/evidence-index.sha256"
FINAL_ARCHIVE="/root/sanquan-mysql01-q064-evidence-${RUN_ID}.tar.gz"
SENSITIVE_SCAN_TMP="${EVIDENCE_ROOT}/.${RUN_ID}.sensitive-scan.tmp"
MIN_FREE_BYTES=$((8 * 1024 * 1024 * 1024))
TARGET_PORT_RE=':(3306|3308|9201|9202|33060)([[:space:]]|$)'
SEAL_ATTEMPTED=0
SEAL_COMPLETED=0

TARGET_UNITS=(
  mysql56.service
  mysql80.service
  mysql-health56.service
  mysql-health80.service
)

FORMAL_BINARIES=(
  /opt/mysql/5.6.51/bin/mysqld
  /opt/mysql/8.0.46/bin/mysqld
)

FORMAL_UNIT_FILES=(
  /etc/systemd/system/mysql56.service
  /etc/systemd/system/mysql80.service
  /etc/systemd/system/mysql-health56.service
  /etc/systemd/system/mysql-health80.service
)

FRAMEWORK_FILES=(
  "${SEAL_SCRIPT}"
  "${POST_CLONE_SCRIPT}"
  "${BUNDLE_ROOT}/common/bin/role-action.sh"
  "${BUNDLE_ROOT}/common/lib/runtime.sh"
  "${BUNDLE_ROOT}/roles/mysql/hooks.sh"
  "${BUNDLE_ROOT}/roles/mysql/role.env"
  "${BUNDLE_ROOT}/roles/mysql/manifests/systemd-units.tsv"
  "${BUNDLE_ROOT}/roles/mysql/manifests/nodes.tsv"
)

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

on_exit() {
  local rc=$?
  set +e
  rm -f "${SENSITIVE_SCAN_TMP}"
  if [[ "${rc}" -ne 0 && -d "${EVIDENCE_DIR}" ]]; then
    {
      printf 'failed_at=%s\n' "$(date --iso-8601=seconds)"
      printf 'exit_code=%s\n' "${rc}"
      printf 'seal_attempted=%s\n' "${SEAL_ATTEMPTED}"
      printf 'seal_completed=%s\n' "${SEAL_COMPLETED}"
      printf 'services_must_remain_quiescent=YES\n'
      printf 'automatic_rerun=FORBIDDEN\n'
      printf 'automatic_identity_restore=FORBIDDEN\n'
    } >"${EVIDENCE_DIR}/failure.env"
    chmod 0600 "${EVIDENCE_DIR}/failure.env"
  fi
  trap - EXIT
  exit "${rc}"
}
trap on_exit EXIT

capture() {
  local name=$1
  shift
  {
    printf '# captured_at=%s\n' "$(date --iso-8601=seconds)"
    printf '# command='
    printf '%q ' "$@"
    printf '\n'
    "$@"
  } >"${EVIDENCE_DIR}/${name}.txt" 2>&1
}

capture_shell() {
  local name=$1
  local command=$2
  {
    printf '# captured_at=%s\n' "$(date --iso-8601=seconds)"
    printf '# command=%s\n' "${command}"
    bash -Eeuo pipefail -c "${command}"
  } >"${EVIDENCE_DIR}/${name}.txt" 2>&1
}

assert_file_sha256() {
  local path=$1
  local expected=$2
  [[ -f "${path}" && ! -L "${path}" ]] || die "required regular file is missing or unsafe: ${path}"
  [[ "$(sha256sum "${path}" | awk '{print $1}')" == "${expected}" ]] || \
    die "SHA256 mismatch: ${path}"
}

assert_result_line() {
  local file=$1
  local line=$2
  grep -Fxq "${line}" "${file}" || die "required result line is missing: ${line}"
}

assert_snapshot_unchanged() {
  local before=$1
  local after=$2
  local label=$3
  cmp -s <(sed -n '3,$p' "${before}") <(sed -n '3,$p' "${after}") || \
    die "${label} changed during seal"
}

assert_units_quiescent() {
  local output=$1
  : >"${output}"
  local unit enabled active substate
  for unit in "${TARGET_UNITS[@]}"; do
    enabled=$(systemctl is-enabled "${unit}" 2>/dev/null || true)
    active=$(systemctl show "${unit}" -p ActiveState --value)
    substate=$(systemctl show "${unit}" -p SubState --value)
    printf '%s\t%s\t%s\t%s\n' "${unit}" "${enabled}" "${active}" "${substate}" >>"${output}"
    [[ "${enabled}" == "disabled" ]] || die "unit is not disabled: ${unit}"
    [[ "${active}" == "inactive" ]] || die "unit is not inactive: ${unit}"
    [[ "${substate}" == "dead" ]] || die "unit is not dead: ${unit}"
  done
}

assert_no_mysqld() {
  local output=$1
  pgrep -a -x mysqld >"${output}" 2>&1 || true
  [[ ! -s "${output}" ]] || die "mysqld process remains"
}

assert_no_target_listeners() {
  local output=$1
  ss -lntupH >"${output}"
  ! grep -Eq "${TARGET_PORT_RE}" "${output}" || die "target listener remains"
}

assert_formal_data_empty() {
  local output=$1
  : >"${output}"
  local base child
  for base in /data/mysql56 /data/mysql80; do
    [[ -d "${base}" && ! -L "${base}" ]] || die "formal data directory is missing or unsafe: ${base}"
    for child in binlog relay; do
      [[ -d "${base}/${child}" && ! -L "${base}/${child}" ]] || \
        die "required empty directory is missing or unsafe: ${base}/${child}"
    done
    find "${base}" -mindepth 1 -printf '%y\t%p\n' | sort >>"${output}"
    if find "${base}" -mindepth 1 ! -type d -print -quit | grep -q .; then
      die "formal data contains non-directory state: ${base}"
    fi
    if find "${base}" -mindepth 1 -type d \
      ! -path "${base}/binlog" ! -path "${base}/relay" -print -quit | grep -q .; then
      die "formal data contains an unexpected directory: ${base}"
    fi
  done
}

assert_logs_safe() {
  local output=$1
  local require_empty=$2
  : >"${output}"
  local base
  for base in /var/log/mysql56 /var/log/mysql80; do
    [[ -d "${base}" && ! -L "${base}" ]] || die "log directory is missing or unsafe: ${base}"
    find "${base}" -mindepth 1 -printf '%y\t%p\n' | sort >>"${output}"
    if find "${base}" -mindepth 1 ! -type d ! -type f -print -quit | grep -q .; then
      die "log directory contains unsafe state: ${base}"
    fi
    if [[ "${require_empty}" == "YES" ]] && \
      find "${base}" -mindepth 1 -type f -print -quit | grep -q .; then
      die "log files remain after seal: ${base}"
    fi
  done
}

assert_runtime_identity_absent() {
  local output=$1
  : >"${output}"
  local path state
  for path in /etc/my56.cnf /etc/my80.cnf /etc/zhct/node.env /etc/zhct/secrets; do
    state=ABSENT
    [[ ! -e "${path}" && ! -L "${path}" ]] || state=PRESENT
    printf '%s\t%s\n' "${path}" "${state}" >>"${output}"
    [[ "${state}" == "ABSENT" ]] || die "runtime identity/config remains: ${path}"
  done
}

assert_space_gate() {
  local output=$1
  local available total percent
  available=$(df -PB1 / | awk 'NR == 2 {print $4}')
  total=$(df -PB1 / | awk 'NR == 2 {print $2}')
  percent=$((available * 100 / total))
  {
    printf 'root_available_bytes=%s\n' "${available}"
    printf 'root_total_bytes=%s\n' "${total}"
    printf 'root_available_percent=%s\n' "${percent}"
    printf 'minimum_available_bytes=%s\n' "${MIN_FREE_BYTES}"
    printf 'minimum_available_percent=20\n'
  } >"${output}"
  [[ "${available}" -ge "${MIN_FREE_BYTES}" ]] || die "root free bytes below 8GiB gate"
  [[ "${percent}" -ge 20 ]] || die "root free percentage below 20% gate"
}

assert_preseal_identity_present() {
  local output=$1
  [[ -f /etc/machine-id && ! -L /etc/machine-id && -s /etc/machine-id ]] || \
    die "machine-id is missing, unsafe or already empty before seal"
  find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key*' -printf '%f\n' | sort >"${output}"
  [[ -s "${output}" ]] || die "no SSH host keys found before seal"
  if grep -Ev '^(ssh_host_(ecdsa|ed25519|rsa)_key)(\.pub)?$' "${output}" | grep -q .; then
    die "unexpected SSH host key type would survive the canonical seal"
  fi
}

assert_clone_identity_removed() {
  local output=$1
  local machine_size key_count
  [[ -f /etc/machine-id && ! -L /etc/machine-id ]] || die "/etc/machine-id is missing or unsafe"
  machine_size=$(stat -c '%s' /etc/machine-id)
  [[ "${machine_size}" -eq 0 ]] || die "/etc/machine-id is not empty"
  [[ ! -e /var/lib/dbus/machine-id && ! -L /var/lib/dbus/machine-id ]] || \
    die "DBus machine-id remains"
  key_count=$(find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key*' -print | wc -l)
  [[ "${key_count}" -eq 0 ]] || die "SSH host key remains"
  {
    printf 'etc_machine_id_bytes=%s\n' "${machine_size}"
    printf 'dbus_machine_id=ABSENT\n'
    printf 'ssh_host_key_file_count=%s\n' "${key_count}"
  } >"${output}"
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ "${MODE}" == "--execute-seal" ]] || die "explicit --execute-seal is required"
[[ "${RUN_ID}" =~ ^q064-[0-9]{8}T[0-9]{6}\+0800$ ]] || die "invalid Q064 run id"
[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
[[ "$(tr -d '\r' </etc/openEuler-release)" == "${EXPECTED_OS}" ]] || die "OS mismatch"
[[ "$(uname -m)" == "${EXPECTED_ARCH}" ]] || die "architecture mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 | \
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"

for command in awk bash chmod cmp cp cut date df dnf env find grep hostname \
  install ip pgrep sed sha256sum sort ssh-keygen ss stat systemctl tar tr uname wc xargs; do
  command -v "${command}" >/dev/null 2>&1 || die "required command is missing: ${command}"
done

[[ ! -e "${EVIDENCE_DIR}" && ! -L "${EVIDENCE_DIR}" ]] || die "Q064 evidence run exists"
[[ ! -e "${FINAL_ARCHIVE}" && ! -L "${FINAL_ARCHIVE}" ]] || die "Q064 archive exists"
install -d -m 0700 "${EVIDENCE_ROOT}" "${EVIDENCE_DIR}"
cp -a "$0" "${EVIDENCE_DIR}/q064-seal-mysql01.sh"
chmod 0600 "${EVIDENCE_DIR}/q064-seal-mysql01.sh"

assert_file_sha256 "${SEAL_SCRIPT}" "${EXPECTED_SEAL_WRAPPER_SHA256}"
assert_file_sha256 "${POST_CLONE_SCRIPT}" "${EXPECTED_POST_CLONE_WRAPPER_SHA256}"
assert_file_sha256 "${BUNDLE_ROOT}/common/bin/role-action.sh" "${EXPECTED_ROLE_ACTION_SHA256}"
assert_file_sha256 "${BUNDLE_ROOT}/common/lib/runtime.sh" "${EXPECTED_RUNTIME_SHA256}"
assert_file_sha256 "${BUNDLE_ROOT}/roles/mysql/hooks.sh" "${EXPECTED_MYSQL_HOOKS_SHA256}"
assert_file_sha256 "${BUNDLE_ROOT}/roles/mysql/role.env" "${EXPECTED_ROLE_ENV_SHA256}"
assert_file_sha256 "${BUNDLE_ROOT}/roles/mysql/manifests/systemd-units.tsv" "${EXPECTED_UNITS_SHA256}"
assert_file_sha256 "${BUNDLE_ROOT}/roles/mysql/manifests/nodes.tsv" "${EXPECTED_NODES_SHA256}"
capture framework-sha256 sha256sum "${FRAMEWORK_FILES[@]}"
capture_shell framework-bash-syntax \
  "for file in '${SEAL_SCRIPT}' '${POST_CLONE_SCRIPT}' '${BUNDLE_ROOT}/common/bin/role-action.sh' '${BUNDLE_ROOT}/common/lib/runtime.sh' '${BUNDLE_ROOT}/roles/mysql/hooks.sh'; do bash -n \"\${file}\"; done"

[[ -f "${Q063_RESULT}" && ! -L "${Q063_RESULT}" ]] || die "Q063 result is missing"
for line in \
  "run_id=${EXPECTED_Q063_RUN_ID}" \
  "hook_update=PASS" \
  "network_namespace=NO_ROUTES" \
  "offline_install_idempotence=PASS" \
  "offline_role_verify=PASS" \
  "rpm_set_unchanged=PASS" \
  "dnf_history_unchanged=PASS" \
  "runtime_sha256_unchanged=PASS" \
  "formal_data_initialized=NOT_PERFORMED" \
  "post_clone_execution=NOT_PERFORMED" \
  "service_activation=NOT_PERFORMED"; do
  assert_result_line "${Q063_RESULT}" "${line}"
done
assert_file_sha256 "${Q063_ARCHIVE}" "${EXPECTED_Q063_ARCHIVE_SHA256}"
cp -a "${Q063_RESULT}" "${EVIDENCE_DIR}/q063-result-copy.env"

capture hostname-before hostnamectl
capture ipv4-before ip -4 -br addr
capture routes-before ip route show table all
capture dnf-history-before dnf history list
capture_shell dnf-history-ids-before "dnf history list | awk '\$1 ~ /^[0-9]+$/ {print \$1}'"
capture filesystems-before df -hT
capture inodes-before df -hi
capture binaries-before sha256sum "${FORMAL_BINARIES[@]}"
capture unit-files-before sha256sum "${FORMAL_UNIT_FILES[@]}"
assert_units_quiescent "${EVIDENCE_DIR}/units-before.tsv"
assert_no_mysqld "${EVIDENCE_DIR}/mysqld-before.txt"
assert_no_target_listeners "${EVIDENCE_DIR}/listeners-before.txt"
assert_formal_data_empty "${EVIDENCE_DIR}/formal-data-before.tsv"
assert_logs_safe "${EVIDENCE_DIR}/logs-before.tsv" NO
assert_runtime_identity_absent "${EVIDENCE_DIR}/runtime-identity-before.tsv"
assert_space_gate "${EVIDENCE_DIR}/space-before.env"
assert_preseal_identity_present "${EVIDENCE_DIR}/ssh-host-key-files-before.txt"
find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*.pub' -print0 | \
  sort -z | xargs -0 -r -n 1 ssh-keygen -lf >"${EVIDENCE_DIR}/ssh-host-public-fingerprints-before.txt"

capture seal-dry-run bash "${SEAL_SCRIPT}" --role mysql --bundle-root "${BUNDLE_ROOT}" --dry-run
capture post-clone-dry-run-before env RUN_ID="${RUN_ID}-dry-before" \
  bash "${POST_CLONE_SCRIPT}" --role mysql --node mysql01 \
  --expected-ip "${EXPECTED_IPV4}" --bundle-root "${BUNDLE_ROOT}" --dry-run

SEAL_ATTEMPTED=1
capture seal-live env RUN_ID="${RUN_ID}" \
  bash "${SEAL_SCRIPT}" --role mysql --bundle-root "${BUNDLE_ROOT}" --confirm-seal
SEAL_COMPLETED=1

assert_units_quiescent "${EVIDENCE_DIR}/units-after.tsv"
assert_no_mysqld "${EVIDENCE_DIR}/mysqld-after.txt"
assert_no_target_listeners "${EVIDENCE_DIR}/listeners-after.txt"
assert_formal_data_empty "${EVIDENCE_DIR}/formal-data-after.tsv"
assert_logs_safe "${EVIDENCE_DIR}/logs-after.tsv" YES
assert_runtime_identity_absent "${EVIDENCE_DIR}/runtime-identity-after.tsv"
assert_clone_identity_removed "${EVIDENCE_DIR}/clone-identity-after.env"
assert_space_gate "${EVIDENCE_DIR}/space-after.env"

capture ipv4-after ip -4 -br addr
capture routes-after ip route show table all
capture dnf-history-after dnf history list
capture_shell dnf-history-ids-after "dnf history list | awk '\$1 ~ /^[0-9]+$/ {print \$1}'"
capture filesystems-after df -hT
capture inodes-after df -hi
capture binaries-after sha256sum "${FORMAL_BINARIES[@]}"
capture unit-files-after sha256sum "${FORMAL_UNIT_FILES[@]}"
capture framework-sha256-after sha256sum "${FRAMEWORK_FILES[@]}"

assert_snapshot_unchanged "${EVIDENCE_DIR}/ipv4-before.txt" "${EVIDENCE_DIR}/ipv4-after.txt" "IPv4"
assert_snapshot_unchanged "${EVIDENCE_DIR}/routes-before.txt" "${EVIDENCE_DIR}/routes-after.txt" "routes"
assert_snapshot_unchanged "${EVIDENCE_DIR}/dnf-history-ids-before.txt" \
  "${EVIDENCE_DIR}/dnf-history-ids-after.txt" "DNF history"
assert_snapshot_unchanged "${EVIDENCE_DIR}/binaries-before.txt" \
  "${EVIDENCE_DIR}/binaries-after.txt" "MySQL binaries"
assert_snapshot_unchanged "${EVIDENCE_DIR}/unit-files-before.txt" \
  "${EVIDENCE_DIR}/unit-files-after.txt" "unit files"
assert_snapshot_unchanged "${EVIDENCE_DIR}/framework-sha256.txt" \
  "${EVIDENCE_DIR}/framework-sha256-after.txt" "framework"

capture post-clone-dry-run-after env RUN_ID="${RUN_ID}-dry-after" \
  bash "${POST_CLONE_SCRIPT}" --role mysql --node mysql01 \
  --expected-ip "${EXPECTED_IPV4}" --bundle-root "${BUNDLE_ROOT}" --dry-run

find "${EVIDENCE_DIR}" -type f \( -name '*.pem' -o -name '*.key' -o -name 'ssh_host_*' \) -print \
  >"${EVIDENCE_DIR}/forbidden-private-files.txt"
[[ ! -s "${EVIDENCE_DIR}/forbidden-private-files.txt" ]] || die "private key-like evidence found"
if grep -RInE \
  '(BEGIN[[:space:]]+(RSA|EC|OPENSSH)?[[:space:]]*PRIVATE KEY|AKIA[0-9A-Z]{16}|(password|passwd|token|cookie|secret)[[:space:]]*[:=][[:space:]]*[^_[:space:]]{6,})' \
  "${EVIDENCE_DIR}" --exclude='q064-seal-mysql01.sh' >"${SENSITIVE_SCAN_TMP}"; then
  mv "${SENSITIVE_SCAN_TMP}" "${EVIDENCE_DIR}/sensitive-scan.txt"
  die "sensitive-looking content found"
fi
rm -f "${SENSITIVE_SCAN_TMP}"
printf 'PASS\n' >"${EVIDENCE_DIR}/sensitive-scan.txt"

{
  printf 'run_id=%s\n' "${RUN_ID}"
  printf 'completed_at=%s\n' "$(date --iso-8601=seconds)"
  printf 'q063_evidence_gate=PASS\n'
  printf 'target_identity=PASS\n'
  printf 'framework_integrity=PASS\n'
  printf 'preseal_quiescence=PASS\n'
  printf 'seal_dry_run=PASS\n'
  printf 'post_clone_dry_run=PASS\n'
  printf 'live_seal=PASS\n'
  printf 'clone_identity_removed=PASS\n'
  printf 'formal_data_files=0\n'
  printf 'target_listener_count=0\n'
  printf 'mysqld_process_count=0\n'
  printf 'machine_id_bytes=0\n'
  printf 'ssh_host_key_file_count=0\n'
  printf 'service_activation=NOT_PERFORMED\n'
  printf 'post_clone_execution=NOT_PERFORMED\n'
  printf 'template_state=SEALED_AWAITING_CUSTOMER_APPLICATION\n'
  printf 'guest_reboot_or_reconnect=FORBIDDEN\n'
  printf 'next_task=Q120_CUSTOMER_TEMPLATE_APPLICATION\n'
  printf 'final_check=PASS\n'
} >"${FINAL_RESULT}"
chmod 0600 "${FINAL_RESULT}"

find "${EVIDENCE_DIR}" -type l -print >"${EVIDENCE_DIR}/symlinks.txt"
[[ ! -s "${EVIDENCE_DIR}/symlinks.txt" ]] || die "evidence contains a symbolic link"
(
  cd "${EVIDENCE_DIR}"
  find . -type f ! -name 'evidence-index.sha256' -print0 | \
    sort -z | xargs -0 sha256sum >"$(basename "${FINAL_INDEX}")"
)
chmod 0600 "${FINAL_INDEX}"
(
  cd "${EVIDENCE_ROOT}"
  tar -czf "${FINAL_ARCHIVE}" "${RUN_ID}"
)
sha256sum "${FINAL_ARCHIVE}" >"${FINAL_ARCHIVE}.sha256"
chmod 0600 "${FINAL_ARCHIVE}" "${FINAL_ARCHIVE}.sha256"

printf 'Q064_MYSQL01_TEMPLATE_SEAL_OK\n'
printf 'run_id=%s\n' "${RUN_ID}"
printf 'evidence=%s\n' "${EVIDENCE_DIR}"
printf 'archive=%s\n' "${FINAL_ARCHIVE}"
printf 'archive_sha256=%s\n' "$(awk '{print $1}' "${FINAL_ARCHIVE}.sha256")"
printf 'template_state=SEALED_AWAITING_CUSTOMER_APPLICATION\n'
printf 'DO_NOT_REBOOT_RECONNECT_OR_RUN_MORE_COMMANDS\n'