#!/usr/bin/env bash
# Real PID1/Unix-credential tests in an owned rootless container, never host units.
set -euo pipefail
ROOT=$(git rev-parse --show-toplevel)
ATTEMPT=${1:?supply a unique attempt name}
REPORT=${2:?supply a new absolute report directory}
[[ "$ATTEMPT" =~ ^[a-z0-9-]+$ && "$REPORT" = /* && ! -e "$REPORT" ]]
[[ $(id -u) != 0 ]]
[[ $(podman info --format '{{.Host.Security.Rootless}}') == true ]]
IMAGE=$(podman image inspect localhost/archipelago-rootfs:latest --format '{{.Id}}')
NAME="archy-d09-systemd-$ATTEMPT"
! podman container exists "$NAME"
umask 077
mkdir "$REPORT"
sources=(scripts/d09-lifecycle-owner.py scripts/d09-lifecycle-client.py scripts/d09_store.py
    scripts/d09_worker.py scripts/d09_wire.py scripts/d09-wire-schema.json
    scripts/provision-d09-lifecycle.py scripts/test-d09-systemd-isolated.sh
    scripts/d09_handoff.py scripts/d09_c01.py scripts/c01_access_generation.py scripts/c01_access_policy.py
    scripts/c01_access_client.py scripts/c01_network.py scripts/c01_runtime.py scripts/c01_runtime_view.py
    scripts/c01_runtime_groups.py scripts/runtime_owner.py scripts/c01_children.py scripts/c01_d09.py
    tests/regression/d09-systemd.py tests/regression/d09-systemd-reboot.py image-recipe/configs/50-d09-lifecycle.conf
    image-recipe/configs/archipelago-d09-lifecycle.service
    image-recipe/configs/60-terminal-workspace.conf image-recipe/configs/prepare-terminal-workspace.sh)
sha256sum "${sources[@]}" > "$REPORT/source-sha256.txt"
printf '%s\n' "$IMAGE" > "$REPORT/image-id.txt"
cleanup() {
    local status=$?
    podman exec "$NAME" journalctl -u archipelago-d09-lifecycle.service -u archipelago.service --no-pager > "$REPORT/journal.log" 2>&1 || true
    podman logs "$NAME" > "$REPORT/container.log" 2>&1 || true
    podman stop --time 10 "$NAME" > "$REPORT/stop.log" 2>&1 || true
    printf '%s\n' "$status" > "$REPORT/exit-code.txt"
}
podman run --detach --pull=never --name "$NAME" --hostname d09-qualification \
    --network=none --cgroupns=private --systemd=always \
    --cap-add=SYS_ADMIN --cap-add=SYS_PTRACE --memory=1g --cpus=1 --pids-limit=256 \
    --tmpfs /run --tmpfs /tmp --entrypoint /sbin/init "$IMAGE" \
    --unit=basic.target --log-target=console > "$REPORT/container-id.txt"
trap cleanup EXIT
podman exec "$NAME" install -d /opt/d09-fixture/image-recipe /opt/d09-fixture/tests/regression
podman cp "$ROOT/scripts" "$NAME:/opt/d09-fixture/scripts"
podman cp "$ROOT/image-recipe/configs" "$NAME:/opt/d09-fixture/image-recipe/configs"
podman cp "$ROOT/tests/regression/d09-systemd.py" "$NAME:/opt/d09-fixture/tests/regression/d09-systemd.py"
podman cp "$ROOT/tests/regression/d09-systemd-reboot.py" "$NAME:/opt/d09-fixture/tests/regression/d09-systemd-reboot.py"
podman exec "$NAME" chown -R root:root /opt/d09-fixture
podman exec --workdir /opt/d09-fixture "$NAME" sha256sum "${sources[@]}" > "$REPORT/container-source-sha256.txt"
cmp "$REPORT/source-sha256.txt" "$REPORT/container-source-sha256.txt"
podman exec --env D09_DISPOSABLE_SYSTEMD=1 "$NAME" python3 \
    /opt/d09-fixture/tests/regression/d09-systemd.py 2>&1 | tee "$REPORT/test.log"
podman restart --time 10 "$NAME" > "$REPORT/pid1-restart.log"
podman exec --env D09_DISPOSABLE_SYSTEMD=1 "$NAME" python3 \
    /opt/d09-fixture/tests/regression/d09-systemd-reboot.py 2>&1 | tee "$REPORT/pid1-restart-test.log"
sha256sum --check "$REPORT/source-sha256.txt" > "$REPORT/source-unchanged.txt"
podman cp "$NAME:/var/lib/archipelago-d09" "$REPORT/authority-evidence"
podman cp "$NAME:/opt/d09-fixture/external-history" "$REPORT/external-fixture-history"