#!/usr/bin/env bash
# Local opt-in public deb download/hash test. No extraction, APT or installation.
# Called by probe-docker-repository.sh after authenticated metadata verification.
set -euo pipefail
[[ $# == 3 && -f "$1" && -d "$2" ]]
binary=$1
metadata_dir=$2
metadata_request=$3
probe_dir=$(mktemp -d /tmp/server-deploy-artifacts.XXXXXX)
chmod 700 "$probe_dir"
artifact_dir="$probe_dir/debs"
mkdir -m 700 "$artifact_dir"
# Only authenticated lock paths, fixed origin, no caller-provided download URLs.
python3 -I -c 'import json,re,sys; r=json.load(sys.stdin); assert r["repositoryAuthenticated"] is True; p=r["lock"]["packages"]; assert len(p)==5; [None if re.fullmatch(r"dists/resolute/pool/stable/amd64/[a-z0-9.+~_-]+\.deb",x["filename"]) and 0<x["size"]<=536870912 else sys.exit(1) for x in p]; [print(x["filename"],x["size"]) for x in p]' < "$metadata_dir/result.json" > "$probe_dir/downloads"
while read -r filename size; do
  curl --fail --silent --show-error --proto '=https' --max-time 90 --max-filesize "$size" \
    "https://download.docker.com/linux/ubuntu/$filename" -o "$artifact_dir/${filename##*/}"
done < "$probe_dir/downloads"
request=$(printf '%s\n' "$metadata_request" | python3 -I -c 'import json,sys; r=json.load(sys.stdin); r["artifactDirectory"]=sys.argv[1]; print(json.dumps(r))' "$artifact_dir")
printf '%s\n' "$request" | "$binary" verify-artifacts > "$probe_dir/result.json"
python3 -I -c 'import json,sys; r=json.load(sys.stdin); assert r["repositoryAuthenticated"] is True; assert r["packageBytesVerified"] is True; assert r["executable"] is False; assert len(r["lock"]["packages"])==5' < "$probe_dir/result.json"
cat "$probe_dir/result.json"
# Same-size mutation: digest comparison, not an earlier size check, must reject.
first=$(head -n 1 "$probe_dir/downloads")
filename=${first% *}
printf 'X' | dd of="$artifact_dir/${filename##*/}" bs=1 count=1 conv=notrunc status=none
if printf '%s\n' "$request" | "$binary" verify-artifacts > "$probe_dir/rejected.json"; then
  printf 'ERROR: same-size deb tamper accepted\n' >&2
  exit 1
fi
[[ ! -s "$probe_dir/rejected.json" ]]
printf 'Five real deb files verified; same-size tamper rejected. Local artifacts: %s\n' "$artifact_dir"