#!/bin/sh
set -eu

repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT HUP INT TERM

assert_no_process_test_seam() {
  artifact=$1
  if LC_ALL=C grep -a -F \
    -e 'proxyctl_process_test' \
    -e 'PROXYCTL_PROCESS_TEST_HOME' \
    "$artifact" >/dev/null
  then
    printf 'release artifact contains the process-test seam: %s\n' "$artifact" >&2
    return 1
  fi
}

VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/first"
VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/second"
GOFLAGS='-tags=proxyctl_process_test' \
  VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/malicious-goflags"
printf 'GOFLAGS=-tags=proxyctl_process_test\n' >"$work/malicious-goenv"
GOENV="$work/malicious-goenv" \
  VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/malicious-goenv-build"

for arch in amd64 arm64; do
  binary="proxyctl-linux-$arch"
  test -x "$work/first/$binary"
  cmp "$work/first/$binary" "$work/second/$binary"
  cmp "$work/first/$binary" "$work/malicious-goflags/$binary"
  cmp "$work/first/$binary" "$work/malicious-goenv-build/$binary"
  assert_no_process_test_seam "$work/first/$binary"
  assert_no_process_test_seam "$work/malicious-goflags/$binary"
  assert_no_process_test_seam "$work/malicious-goenv-build/$binary"
done
cmp "$work/first/SHA256SUMS" "$work/second/SHA256SUMS"
cmp "$work/first/SHA256SUMS" "$work/malicious-goflags/SHA256SUMS"
cmp "$work/first/SHA256SUMS" "$work/malicious-goenv-build/SHA256SUMS"

(
  cd "$repo"
  GOENV=off GOFLAGS= CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -mod=readonly -buildvcs=false -trimpath \
    -tags=proxyctl_process_test -o "$work/known-contaminated" ./cmd/proxyctl
)
if assert_no_process_test_seam "$work/known-contaminated"; then
  echo 'release artifact validation accepted a known contaminated binary' >&2
  exit 1
fi
printf 'process-test seam scan rejected a known contaminated binary\n'

(
  cd "$work/first"
  sha256sum -c SHA256SUMS
)

amd64_format=$(file -b "$work/first/proxyctl-linux-amd64")
arm64_format=$(file -b "$work/first/proxyctl-linux-arm64")
printf '%s\n' "$amd64_format" | grep -Eq 'ELF 64-bit.*(x86-64|x86_64)'
printf '%s\n' "$arm64_format" | grep -Eq 'ELF 64-bit.*(ARM aarch64|aarch64)'

# Only execute the binary matching the build host; format checks cover both.
case $(go env GOARCH) in
  amd64) test "$($work/first/proxyctl-linux-amd64 version --short)" = v1.0.0 ;;
  arm64) test "$($work/first/proxyctl-linux-arm64 version --short)" = v1.0.0 ;;
esac

printf 'amd64: %s\narm64: %s\nrelease automation is reproducible and checksums verify\n' "$amd64_format" "$arm64_format"