#!/bin/bash
# =============================================================================
# scripts/checksums.sh
#
# Verifies and consolidates checksums for everything in dist/. Each package
# already gets its own <file>.sha256 / <file>.md5 sidecar file from
# sb_make_package (scripts/lib/slackbuild-common.sh) at build time — this
# script:
#   1. Re-verifies every .txz against its own sidecar checksum (defense in
#      depth: catches disk corruption or a tampered artifact between the
#      build job and the release job in CI).
#   2. Writes a single consolidated CHECKSUMS.sha256 manifest covering all
#      built packages, suitable for attaching to a GitHub Release so users
#      can verify the whole set with one `sha256sum -c CHECKSUMS.sha256`.
#
# Usage:
#   scripts/checksums.sh [dist-dir]      # defaults to <repo>/dist
# =============================================================================

set -eu

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
DIST_DIR="${1:-$REPO_ROOT/dist}"

if [ ! -d "$DIST_DIR" ]; then
  echo "!! No such directory: $DIST_DIR (nothing built yet?)" >&2
  exit 1
fi

shopt -s nullglob
txz_files=("$DIST_DIR"/*.txz)
shopt -u nullglob

if [ "${#txz_files[@]}" -eq 0 ]; then
  echo "!! No .txz files found in $DIST_DIR" >&2
  exit 1
fi

echo "==> Verifying per-package checksums"
verify_failed=0
for f in "${txz_files[@]}"; do
  base=$(basename "$f")
  sidecar="$f.sha256"
  if [ ! -f "$sidecar" ]; then
    echo "!! Missing $sidecar for $base" >&2
    verify_failed=1
    continue
  fi
  if ( cd "$DIST_DIR" && sha256sum -c "$(basename "$sidecar")" > /dev/null 2>&1 ); then
    echo "OK   $base"
  else
    echo "FAIL $base" >&2
    verify_failed=1
  fi
done

if [ "$verify_failed" -ne 0 ]; then
  echo "!! Checksum verification failed for one or more packages." >&2
  exit 1
fi

echo
echo "==> Writing consolidated manifest: $DIST_DIR/CHECKSUMS.sha256"
( cd "$DIST_DIR" && sha256sum ./*.txz > CHECKSUMS.sha256 )

echo "==> Writing consolidated MD5 manifest: $DIST_DIR/CHECKSUMS.md5"
( cd "$DIST_DIR" && md5sum ./*.txz > CHECKSUMS.md5 )

echo "==> Done."
cat "$DIST_DIR/CHECKSUMS.sha256"