#!/usr/bin/env bash
# Fetch and verify every binary input required by the loopless image composer.

set -Eeuo pipefail
umask 022

SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
PROJECT_DIR=$(cd -- "$SCRIPT_DIR/.." && pwd -P)
LOCK_FILE="$PROJECT_DIR/inputs.lock.json"
DOWNLOAD_DIR="$PROJECT_DIR/downloads"

for command_name in curl git jq sha256sum stat; do
  command -v "$command_name" >/dev/null || {
    echo "Missing command: $command_name" >&2
    exit 1
  }
done
mkdir -p "$DOWNLOAD_DIR" "$PROJECT_DIR/work/sources"

fetch_asset() {
  local selector=$1 output_name url expected_size expected_sha output partial
  output_name=$(jq -er "$selector.output_name" "$LOCK_FILE")
  url=$(jq -er "$selector.url" "$LOCK_FILE")
  expected_size=$(jq -er "$selector.size" "$LOCK_FILE")
  expected_sha=$(jq -er "$selector.sha256" "$LOCK_FILE")
  output="$DOWNLOAD_DIR/$output_name"
  if [[ ! -f "$output" ]] ||
     [[ "$(stat -c '%s' "$output")" != "$expected_size" ]] ||
     [[ "$(sha256sum "$output" | awk '{print $1}')" != "$expected_sha" ]]; then
    partial="$output.partial"
    rm -f -- "$partial"
    curl --fail --location --show-error --output "$partial" "$url"
    [[ "$(stat -c '%s' "$partial")" == "$expected_size" ]] || {
      echo "Size mismatch for $output_name" >&2
      exit 1
    }
    echo "$expected_sha  $partial" | sha256sum --check --status || {
      echo "Checksum mismatch for $output_name" >&2
      exit 1
    }
    mv -- "$partial" "$output"
  fi
  echo "Verified $output_name"
}

verify_rknn_bundle() {
  local bundle=$1
  # shellcheck source=../runtime/rknn-version.env
  source "$PROJECT_DIR/runtime/rknn-version.env"
  declare -a checks=(
    "rknpu2/runtime/Linux/librknn_api/include/rknn_api.h:$RKNN_HEADER_SHA256"
    "rknpu2/runtime/Linux/librknn_api/aarch64/librknnrt.so:$RKNN_RUNTIME_AARCH64_SHA256"
    "rknpu2/examples/rknn_api_demo/model/RK3588/mobilenet_v1.rknn:$RKNN_MOBILENET_RK3588_SHA256"
    "rknpu2/examples/rknn_api_demo/model/dog_224x224.jpg:$RKNN_DEMO_IMAGE_SHA256"
    "LICENSE:$RKNN_LICENSE_SHA256"
  )
  local entry path expected
  for entry in "${checks[@]}"; do
    path=${entry%%:*}
    expected=${entry##*:}
    [[ -f "$bundle/$path" ]] || return 1
    [[ "$(sha256sum "$bundle/$path" | awk '{print $1}')" == "$expected" ]] || return 1
  done
}

fetch_asset '.base_image'
fetch_asset '.kodi_upstream_deb'

bundle_name=$(jq -er '.rknn_toolkit2.bundle_directory' "$LOCK_FILE")
bundle="$DOWNLOAD_DIR/$bundle_name"
if ! verify_rknn_bundle "$bundle"; then
  [[ ! -e "$bundle" ]] || {
    echo "Existing RKNN bundle failed verification: $bundle" >&2
    exit 1
  }
  repository=$(jq -er '.rknn_toolkit2.repository' "$LOCK_FILE")
  tag=$(jq -er '.rknn_toolkit2.tag' "$LOCK_FILE")
  commit=$(jq -er '.rknn_toolkit2.commit' "$LOCK_FILE")
  checkout="$PROJECT_DIR/work/sources/rknn-toolkit2-$commit"
  if [[ ! -d "$checkout/.git" ]]; then
    git clone --filter=blob:none --no-checkout "$repository" "$checkout"
    git -C "$checkout" sparse-checkout init --cone
    git -C "$checkout" sparse-checkout set \
      rknpu2/runtime/Linux/librknn_api \
      rknpu2/examples/rknn_api_demo/model
    git -C "$checkout" checkout --detach "$tag"
  fi
  [[ "$(git -C "$checkout" rev-parse HEAD)" == "$commit" ]] || {
    echo "RKNN checkout does not match lock" >&2
    exit 1
  }
  "$PROJECT_DIR/runtime/make-offline-bundle.sh" "$checkout" "$bundle"
fi
verify_rknn_bundle "$bundle" || { echo "RKNN bundle verification failed" >&2; exit 1; }
echo "Verified $bundle_name"

"$PROJECT_DIR/packages/fetch-locked-debs.sh"