#!/usr/bin/env bash
set -Eeuo pipefail
IFS=$'\n\t'

usage() {
  printf '%s\n' \
    "Usage:" \
    "  $0 --output DIRECTORY --amd64 BINARY" \
    "  $0 --output DIRECTORY --arm64 BINARY" \
    "  $0 --output DIRECTORY --amd64 BINARY --arm64 BINARY" \
    "" \
    "The legacy form is still supported:" \
    "  $0 X86_64_BINARY AARCH64_BINARY OUTPUT_DIRECTORY" >&2
}

AMD64_BINARY=""
ARM64_BINARY=""
OUTPUT_DIRECTORY=""

# Preserve the original interface for existing release jobs while allowing each
# architecture to be packaged independently on its native Linux builder.
if [[ $# -eq 3 && "$1" != --* ]]; then
  AMD64_BINARY="$1"
  ARM64_BINARY="$2"
  OUTPUT_DIRECTORY="$3"
else
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --amd64)
        [[ $# -ge 2 ]] || { usage; exit 2; }
        AMD64_BINARY="$2"
        shift 2
        ;;
      --arm64)
        [[ $# -ge 2 ]] || { usage; exit 2; }
        ARM64_BINARY="$2"
        shift 2
        ;;
      --output)
        [[ $# -ge 2 ]] || { usage; exit 2; }
        OUTPUT_DIRECTORY="$2"
        shift 2
        ;;
      -h|--help)
        usage
        exit 0
        ;;
      *)
        printf 'unknown argument: %s\n' "$1" >&2
        usage
        exit 2
        ;;
    esac
  done
fi

[[ -n "$OUTPUT_DIRECTORY" ]] || { printf 'output directory is required\n' >&2; usage; exit 2; }
[[ -n "$AMD64_BINARY" || -n "$ARM64_BINARY" ]] || {
  printf 'at least one architecture binary is required\n' >&2
  usage
  exit 2
}
command -v file >/dev/null || { printf 'file is required\n' >&2; exit 1; }

validate_and_install() {
  local architecture="$1"
  local source="$2"
  local destination="$3"
  local description

  [[ -x "$source" ]] || { printf '%s binary is not executable\n' "$architecture" >&2; exit 1; }
  description="$(file -b "$source")"
  case "$architecture" in
    amd64)
      [[ "$description" == *ELF* && "$description" == *x86-64* ]] || {
        printf 'amd64 artifact is not an x86-64 Linux ELF binary\n' >&2
        exit 1
      }
      ;;
    arm64)
      [[ "$description" == *ELF* && ("$description" == *aarch64* || "$description" == *ARM64*) ]] || {
        printf 'arm64 artifact is not an aarch64 Linux ELF binary\n' >&2
        exit 1
      }
      ;;
  esac
  install -m 0755 "$source" "$destination"
}

install -d -m 0755 "$OUTPUT_DIRECTORY"
if [[ -n "$AMD64_BINARY" ]]; then
  validate_and_install amd64 "$AMD64_BINARY" "$OUTPUT_DIRECTORY/vps-agent-linux-amd64"
fi
if [[ -n "$ARM64_BINARY" ]]; then
  validate_and_install arm64 "$ARM64_BINARY" "$OUTPUT_DIRECTORY/vps-agent-linux-arm64"
fi

CHECKSUM_FILES=()
[[ -f "$OUTPUT_DIRECTORY/vps-agent-linux-amd64" ]] && CHECKSUM_FILES+=(vps-agent-linux-amd64)
[[ -f "$OUTPUT_DIRECTORY/vps-agent-linux-arm64" ]] && CHECKSUM_FILES+=(vps-agent-linux-arm64)

(
  cd "$OUTPUT_DIRECTORY"
  if command -v sha256sum >/dev/null; then
    sha256sum "${CHECKSUM_FILES[@]}" > SHA256SUMS
  elif command -v shasum >/dev/null; then
    shasum -a 256 "${CHECKSUM_FILES[@]}" > SHA256SUMS
  else
    printf 'sha256sum or shasum is required\n' >&2
    exit 1
  fi
  if [[ -n "${VPS_AGENT_MINISIGN_SECRET_KEY:-}" ]]; then
    command -v minisign >/dev/null || { printf 'minisign is required for signing\n' >&2; exit 1; }
    minisign -Sm SHA256SUMS -s "$VPS_AGENT_MINISIGN_SECRET_KEY"
  fi
)