#!/usr/bin/env bash
# Fetch the exact Debian package payload described by the integrity lock.

set -Eeuo pipefail

SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
PROJECT_DIR=$(cd -- "$SCRIPT_DIR/.." && pwd -P)
LOCK_FILE=${1:-"$SCRIPT_DIR/debian-packages.lock.tsv"}
OUTPUT_DIR=${2:-"$PROJECT_DIR/work/apt/archives"}

[[ -s "$LOCK_FILE" ]] || { echo "Missing package lock: $LOCK_FILE" >&2; exit 1; }
mkdir -p "$OUTPUT_DIR"

while IFS=$'\t' read -r filename expected_size expected_sha url; do
  [[ "$filename" == '# filename' ]] && continue
  [[ -n "$filename" && "$expected_sha" =~ ^[0-9a-f]{64}$ ]] || {
    echo "Malformed package lock row: $filename" >&2
    exit 1
  }
  output="$OUTPUT_DIR/$filename"
  if [[ -f "$output" ]] &&
     [[ "$(stat -c '%s' "$output")" == "$expected_size" ]] &&
     [[ "$(sha256sum "$output" | awk '{print $1}')" == "$expected_sha" ]]; then
    continue
  fi
  partial="$output.partial"
  rm -f -- "$partial"
  curl --fail --location --show-error --output "$partial" "$url"
  [[ "$(stat -c '%s' "$partial")" == "$expected_size" ]] || {
    echo "Size mismatch for $filename" >&2
    exit 1
  }
  echo "$expected_sha  $partial" | sha256sum --check --status || {
    echo "Checksum mismatch for $filename" >&2
    exit 1
  }
  mv -- "$partial" "$output"
done <"$LOCK_FILE"

echo "Verified locked package bundle: $OUTPUT_DIR"