#!/bin/sh
set -eu

archive="${1:-}"
revision="${2:-}"
version="${3:-}"
checksum_file="${4:-${archive}.sha256}"

fail() {
  printf 'source archive verification failed: %s\n' "$1" >&2
  exit 1
}

test -f "$archive" || fail "archive not found: ${archive}"
test -f "$checksum_file" || fail "checksum not found: ${checksum_file}"

archive_directory="$(CDPATH='' cd -- "$(dirname -- "$archive")" && pwd)"
archive_name="$(basename -- "$archive")"
checksum_name="$(basename -- "$checksum_file")"
(cd "$archive_directory" && sha256sum -c "$checksum_name") || fail 'checksum mismatch'

root="docuseal-${revision}"
listing="$(mktemp)"
trap 'rm -f "$listing"' EXIT HUP INT TERM
tar -tzf "$archive" > "$listing"

if grep -Eq '(^/|(^|/)\.\.(/|$))' "$listing"; then
  fail 'archive contains an unsafe path'
fi

if grep -Eq '(^|/)(\.git/|\.env($|\.)|master\.key$|node_modules/|vendor/bundle/|public/packs(-test)?/)|\.(key|pem|p12|pfx|sqlite3)(-|$)' "$listing"; then
  fail 'archive contains a secret-like or generated dependency path'
fi

for required in Dockerfile Gemfile.lock yarn.lock LICENSE LICENSE_ADDITIONAL_TERMS README.md bin/setup .github/workflows/docker.yml .docuseal-build/revision .docuseal-build/version; do
  grep -Fxq "${root}/${required}" "$listing" || fail "required file is missing: ${required}"
done

archived_revision="$(tar -xOzf "$archive" "${root}/.docuseal-build/revision")"
archived_version="$(tar -xOzf "$archive" "${root}/.docuseal-build/version")"
test "$archived_revision" = "$revision" || fail 'embedded revision does not match'
test "$archived_version" = "$version" || fail 'embedded version does not match'

printf 'source archive verified: %s (%s files)\n' "$archive_name" "$(wc -l < "$listing" | tr -d ' ')"
