#!/bin/bash
# Verify a packaged Aligner release directory before it can be referenced by a
# release manifest or uploaded as a direct-download artifact.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
OUTPUT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
SOURCE_ROOT="$OUTPUT_ROOT/C1.source"
INFO_PLIST="$SOURCE_ROOT/Resources/Aligner-Info.plist"

fail() {
  echo "verify-release-artifact.sh failed: $*" >&2
  exit 1
}

usage() {
  echo "Usage: 03-O/C3.tools/verify-release-artifact.sh <release-dir>" >&2
}

RELEASE_DIR="${1:-}"
[ -n "$RELEASE_DIR" ] || { usage; exit 2; }
[ -d "$RELEASE_DIR" ] || fail "release dir does not exist: $RELEASE_DIR"

VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$INFO_PLIST" 2>/dev/null)" \
  || fail "unable to read CFBundleShortVersionString"
BUILD="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$INFO_PLIST" 2>/dev/null)" \
  || fail "unable to read CFBundleVersion"
EXPECTED_DMG="Aligner-${VERSION}-build${BUILD}.dmg"
DMG="$RELEASE_DIR/$EXPECTED_DMG"
SUMS="$RELEASE_DIR/SHA256SUMS.txt"

[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
  || fail "version must be MAJOR.MINOR.PATCH, got: $VERSION"
[[ "$BUILD" =~ ^[0-9]{8}\.[0-9]{4}$ ]] \
  || fail "build must be YYYYMMDD.HHMM, got: $BUILD"
[ -f "$DMG" ] || fail "missing expected DMG: $DMG"
[ -f "$SUMS" ] || fail "missing SHA256SUMS.txt: $SUMS"

EXPECTED_SHA="$(awk -v name="$EXPECTED_DMG" '$2 == name { print $1 }' "$SUMS")"
[ -n "$EXPECTED_SHA" ] || fail "SHA256SUMS.txt does not contain $EXPECTED_DMG"
ACTUAL_SHA="$(shasum -a 256 "$DMG" | awk '{ print $1 }')"
[ "$EXPECTED_SHA" = "$ACTUAL_SHA" ] || fail "SHA256 mismatch for $EXPECTED_DMG"

if codesign -dv "$DMG" >/tmp/aligner-dmg-codesign.$$ 2>&1; then
  if ! rg -q "Developer ID Application" /tmp/aligner-dmg-codesign.$$; then
    rm -f /tmp/aligner-dmg-codesign.$$
    fail "DMG signature is not Developer ID Application"
  fi
else
  rm -f /tmp/aligner-dmg-codesign.$$
  fail "DMG is not signed; formal release artifacts must be Developer ID signed"
fi
rm -f /tmp/aligner-dmg-codesign.$$

echo "Release artifact verified: $DMG"