#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_OFFLINE_NEVRA_SIGNATURE_DIAGNOSIS
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly BUNDLE=/root/q132-semanage-offline-rpms.tar.gz
readonly BUNDLE_SHA256=24aa7c3564a37aa3bfc85c05040720d310ba89c390dd794fb0162d997840b98f
readonly KEY_SHA256=006e79d37c10e74c24df6d07c4efc4176515cec009daa5ed493b06f5b6ef39c1
readonly KEY_FINGERPRINT=8AA16BF9F2CA5244010DCA963B477C60B675600B
readonly FAILED_AUDIT=/var/backups/zhct-q132-offline-semanage-resume/q132-offline-semanage-resume-20260806T015156Z/operator.log
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-offline-nevra-signature-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-offline-nevra-signature-diagnosis/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"
WORK=''
RPMDB=''
static_mode=0

finish() {
    local rc=$?
    set +e
    if [[ -n "$RPMDB" && -d "$RPMDB" && "$RPMDB" == /var/tmp/q132-nevra-rpmdb.* ]]; then
        rm -rf -- "$RPMDB"
    fi
    if [[ -n "$WORK" && -d "$WORK" && "$WORK" == /var/tmp/q132-nevra-diag.* ]]; then
        rm -rf -- "$WORK"
    fi
    if [[ "$static_mode" -eq 1 ]]; then
        printf 'END|%s|RC=%s|AUDIT_LOG=NOT_CREATED_STATIC_VALIDATE\n' "$LABEL" "$rc"
        exit "$rc"
    fi
    if [[ "$rc" -eq 0 ]]; then
        printf '%s\n' 'Q132_OFFLINE_NEVRA_SIGNATURE_DIAGNOSIS=PASS_READ_ONLY'
    else
        printf '%s\n' 'Q132_OFFLINE_NEVRA_SIGNATURE_DIAGNOSIS=FAIL_STOP'
    fi
    printf '%s\n' \
        'PACKAGE_INSTALL=NOT_PERFORMED' \
        'ROLE_ACTIVATION=NOT_PERFORMED' \
        'SERVICE_MUTATION=ZERO' \
        'SELINUX_ACL_MUTATION=ZERO' \
        'SECRET_VALUES=NOT_READ_NOT_OUTPUT_NOT_HASHED' \
        "END|${LABEL}|RC=${rc}|AUDIT_LOG=${AUDIT_LOG}"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    grep -Fq 'LC_ALL=C sort' "$SCRIPT_PATH"
    grep -Fq "'_pkgverify_level signature'" "$SCRIPT_PATH"
    if grep -En 'dnf[[:space:]].*(-y|--assumeyes)|systemctl[[:space:]]+(start|stop|restart|enable|disable)|semanage[[:space:]]+(fcontext|port)[[:space:]]+-(a|m|d)|setfacl[[:space:]]+-|restorecon[[:space:]]' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        return 1
    fi
    printf '%s\n' \
        'Q132_OFFLINE_NEVRA_SIGNATURE_DIAG_STATIC_VALIDATE=PASS' \
        'PACKAGE_INSTALL=PROHIBITED' \
        'ROLE_MUTATION=PROHIBITED'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_mode=1
    static_validate
    exit 0
fi
[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]]
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]]
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP"
printf 'Q132_NEVRA_DIAG_TARGET_IDENTITY=PASS|host=%s|ip=%s\n' "$actual_host" "$EXPECTED_IP"
for command_name in tar sha256sum rpm gpg stat install tee mktemp systemctl ss; do
    command -v "$command_name" >/dev/null 2>&1 || exit 1
done
[[ -f "$BUNDLE" && ! -L "$BUNDLE" && $(stat -c '%U:%G' "$BUNDLE") == root:root ]]
printf '%s  %s\n' "$BUNDLE_SHA256" "$BUNDLE" | sha256sum -c -
[[ -f "$FAILED_AUDIT" && ! -L "$FAILED_AUDIT" ]]
grep -Fq 'Q132_OFFLINE_KEY_GATE=PASS|fingerprint=8AA16BF9F2CA5244010DCA963B477C60B675600B' "$FAILED_AUDIT"
! grep -Fq 'Q132_OFFLINE_NEVRA_GATE=PASS' "$FAILED_AUDIT"
grep -Fq 'Q132_OFFLINE_SEMANAGE_ROLLBACK=NOT_REQUIRED_ZERO_PACKAGE_OR_ROLE_MUTATION' "$FAILED_AUDIT"
printf 'Q132_FAILED_BOUNDARY_GATE=PASS|after=KEY|before=NEVRA_SIGNATURE_DNF\n'

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
printf 'CURRENT_LOCALE|LANG=%s|LC_ALL=%s\n' "${LANG:-UNSET}" "${LC_ALL:-UNSET}"
WORK=$(mktemp -d /var/tmp/q132-nevra-diag.XXXXXX)
tar --no-same-owner -xzf "$BUNDLE" -C "$WORK"
ROOT="$WORK/q132-semanage-offline-rpms"
[[ -d "$ROOT" && ! -L "$ROOT" ]]
(cd "$ROOT" && sha256sum -c SHA256SUMS)
printf '%s  %s\n' "$KEY_SHA256" "$ROOT/RPM-GPG-KEY-openEuler" | sha256sum -c -
fingerprint=$(gpg --batch --show-keys --with-colons "$ROOT/RPM-GPG-KEY-openEuler" 2>/dev/null |
    awk -F: '$1 == "fpr" {print $10; exit}')
[[ "$fingerprint" == "$KEY_FINGERPRINT" ]]

mapfile -d '' rpms < <(find "$ROOT/rpms" -maxdepth 1 -type f -name '*.rpm' -print0 | LC_ALL=C sort -z)
[[ ${#rpms[@]} -eq 8 ]]
printf '%s\n' '=== PER-RPM QUERY ==='
for rpm_file in "${rpms[@]}"; do
    printf 'RPM_FILE=%s\n' "$(basename "$rpm_file")"
    rpm -qp --qf 'RPM_NEVRA=%{NAME}-%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n' "$rpm_file"
done

expected_nevra=$(printf '%s\n' \
    'checkpolicy-0:3.5-1.oe2403sp1.x86_64' \
    'policycoreutils-python-utils-0:3.5-3.oe2403sp1.noarch' \
    'python3-IPy-0:1.01-2.oe2403sp1.noarch' \
    'python3-audit-1:3.1.2-7.oe2403sp1.x86_64' \
    'python3-libselinux-0:3.5-3.oe2403sp1.x86_64' \
    'python3-libsemanage-0:3.5-1.oe2403sp1.x86_64' \
    'python3-policycoreutils-0:3.5-3.oe2403sp1.noarch' \
    'python3-setools-0:4.4.3-1.oe2403sp1.x86_64')
actual_default=$(rpm -qp --qf '%{NAME}-%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n' "${rpms[@]}" 2>/dev/null | sort)
actual_c=$(rpm -qp --qf '%{NAME}-%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n' "${rpms[@]}" 2>/dev/null | LC_ALL=C sort)
printf '%s\n' '=== EXPECTED C ORDER ===' "$expected_nevra"
printf '%s\n' '=== ACTUAL DEFAULT ORDER ===' "$actual_default"
printf '%s\n' '=== ACTUAL C ORDER ===' "$actual_c"
if [[ "$actual_default" == "$expected_nevra" ]]; then
    printf 'DEFAULT_LOCALE_NEVRA_MATCH=PASS\n'
else
    printf 'DEFAULT_LOCALE_NEVRA_MATCH=FAIL\n'
fi
[[ "$actual_c" == "$expected_nevra" ]]
printf 'C_LOCALE_NEVRA_MATCH=PASS\n'

RPMDB=$(mktemp -d /var/tmp/q132-nevra-rpmdb.XXXXXX)
rpm --dbpath "$RPMDB" --initdb
rpm --dbpath "$RPMDB" --import "$ROOT/RPM-GPG-KEY-openEuler"
for rpm_file in "${rpms[@]}"; do
    rpm --dbpath "$RPMDB" --define '_pkgverify_level signature' -K "$rpm_file"
done
printf 'Q132_OFFLINE_RPM_SIGNATURES=PASS_READ_ONLY|rpm_count=8\n'

for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" \
        "$(systemctl is-enabled "$unit" 2>/dev/null || true)" \
        "$(systemctl is-active "$unit" 2>/dev/null || true)"
done
if ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)'; then
    printf 'TARGET_LISTENERS=PRESENT_UNEXPECTED\n'
else
    printf 'TARGET_LISTENERS=NONE\n'
fi