#!/usr/bin/env bash
# Invoke inside the same resource-limited durable systemd job as native fixtures.
set -euo pipefail
ROOT=$(git rev-parse --show-toplevel)
PRIOR=${1:?native fixture receipt}
REPORT=${2:?fresh receipt directory}
IMAGE=${3:?pinned existing NTS principal image}
NAME=${4:?unique fixture container}
[[ "$NAME" =~ ^qualification-c01-nts-[a-z0-9-]+$ && "$REPORT" = /* && ! -e "$REPORT" ]]
exec 9>/tmp/opencode/release-heavy.lock
flock 9
python3 -B "$ROOT/scripts/tests/package_c01_nts_fixture.py" "$ROOT" "$PRIOR" "$REPORT"
cleanup() {
 status=$?
 trap - EXIT
 if podman container exists "$NAME"; then
  podman cp "$NAME:/opt/c01-nts" "$REPORT/evidence" || true
  podman inspect "$NAME" > "$REPORT/container.json" || true
  podman stop --time 10 "$NAME" > "$REPORT/stop.log" 2>&1 || true
 fi
 printf '%s\n' "$status" > "$REPORT/exit-code.txt"
 exit "$status"
}
trap cleanup EXIT
hosts=()
while read -r name address; do hosts+=(--add-host "$name:$address"); done < <(
 python3 -c 'import json,sys; x=json.load(open(sys.argv[1])); [print(n,a) for n,v in x["addresses"].items() for a in v]' "$REPORT/source.json")
CONTAINERS_CONF_OVERRIDE="$REPORT/containers.conf" podman run --detach --pull=never --name "$NAME" --hostname c01-nts-composed \
 --network=pasta --http-proxy=false --cap-drop=ALL --cap-add=CHOWN,DAC_OVERRIDE,FOWNER,SETUID,SETGID,SYS_PTRACE,NET_BIND_SERVICE,KILL,NET_ADMIN \
 --security-opt=no-new-privileges --cpus=2 --memory=8g --memory-swap=8g --pids-limit=128 \
 --tmpfs=/run:rw,size=32m,mode=755 --tmpfs=/tmp:rw,size=32m "${hosts[@]}" \
 --entrypoint=/usr/bin/sleep "$IMAGE" infinity > "$REPORT/container-id.txt"
podman exec "$NAME" mkdir /opt/c01-nts
podman cp "$PRIOR/normal-native.tar" "$NAME:/opt/c01-nts/native.tar"
for file in dependencies.tar probe.py c01_nts.py egress.nft; do podman cp "$REPORT/$file" "$NAME:/opt/c01-nts/$file"; done
podman exec "$NAME" tar -xf /opt/c01-nts/native.tar -C /
podman exec "$NAME" tar -xf /opt/c01-nts/dependencies.tar -C /
podman exec "$NAME" chown -R root:root /opt/c01-nts
podman exec "$NAME" python3 -B /opt/c01-nts/probe.py > "$REPORT/probe.log" 2>&1