#!/bin/sh

set -eu
umask 077
LC_ALL=C
export LC_ALL

ARCHIVE="${1:-broray-webcli-bootstrap-3.0.0-r14c68-b1.tgz}"
SIGNATURE="${2:-broray-webcli-bootstrap-3.0.0-r14c68-b1.tgz.sig}"
PUBLIC_KEY="${3:-broray-bootstrap-rsa3072-v1-public.pem}"
EXPECTED_ARCHIVE_SHA256='50904456e998dc501ee534efca5eccc47b997f9986bf5aef3f959d468ad66dd7'
EXPECTED_PUBLIC_SPKI_SHA256='aaac0ea3b4a6334c8be5626aba4a1a10078526c731ce5392fb41ddb66f033b4a'

for required in "$ARCHIVE" "$SIGNATURE" "$PUBLIC_KEY"; do
    [ -f "$required" ] && [ ! -L "$required" ] || {
        printf 'Required regular file is missing or unsafe: %s\n' "$required" >&2
        exit 1
    }
done

actual_archive_sha256="$(sha256sum "$ARCHIVE" | awk 'NR == 1 { print $1 }')"
[ "$actual_archive_sha256" = "$EXPECTED_ARCHIVE_SHA256" ] || {
    printf 'Archive SHA-256 mismatch: %s\n' "$actual_archive_sha256" >&2
    exit 1
}

actual_public_spki_sha256="$({
    openssl pkey -pubin -in "$PUBLIC_KEY" -outform DER 2>/dev/null |
        sha256sum |
        awk 'NR == 1 { print $1 }'
})"
[ "$actual_public_spki_sha256" = "$EXPECTED_PUBLIC_SPKI_SHA256" ] || {
    printf 'Public-key fingerprint mismatch: %s\n' "$actual_public_spki_sha256" >&2
    exit 1
}

openssl dgst -sha256 -verify "$PUBLIC_KEY" -signature "$SIGNATURE" "$ARCHIVE" >/dev/null

printf '%s\n' 'ARCHIVE_SHA256=PASS'
printf '%s\n' 'PUBLIC_KEY_FINGERPRINT=PASS'
printf '%s\n' 'DETACHED_SIGNATURE=PASS'
printf '%s\n' 'SIGNED_BOOTSTRAP=ACCEPTED'