#!/usr/bin/env bash
# Qualification only: own rootless container, private PID1/cgroups/net, no binds.
set -euo pipefail
ROOT=$(git rev-parse --show-toplevel)
ATTEMPT=${1:?unique attempt required}
REPORT=${2:?new absolute report directory required}
[[ "$ATTEMPT" =~ ^[a-z0-9-]+$ && "$REPORT" = /* && ! -e "$REPORT" ]]
[[ $(id -u) != 0 && $(podman info --format '{{.Host.Security.Rootless}}') == true ]]
NAME="qualification-c01-prerequisite-$ATTEMPT"
! podman container exists "$NAME"
umask 077
mkdir "$REPORT"
sources=(scripts/c01_network.py scripts/c01_supervisor.py scripts/c01_access.py
 scripts/c01_access_kernel.py scripts/c01_access_policy.py scripts/c01_access_client.py
 scripts/c01_runtime.py scripts/c01_runtime_view.py scripts/c01_children.py scripts/c01_views.py
 scripts/runtime_owner.py scripts/c01_runtime_groups.py scripts/c01_nts.py scripts/c01_recovery.py scripts/c01_host_watch.py
 image-recipe/configs/70-c01-supervisor.conf.in image-recipe/configs/80-archipelago-runtime-user.conf.in
 image-recipe/configs/81-c01-runtime-access.conf.in tests/regression/c01-prerequisite-systemd.py
 image-recipe/configs/archipelago-runtime-tmux.service image-recipe/configs/archipelago-runtime-tmux.conf
 scripts/test-c01-prerequisite-systemd-isolated.sh scripts/tests/package_c01_tmux_fixture.py)
sha256sum "${sources[@]}" > "$REPORT/source-sha256.txt"
python3 -B scripts/tests/package_c01_tmux_fixture.py "$REPORT"
IMAGE=$(podman image inspect localhost/archipelago-rootfs:latest --format '{{.Id}}')
printf '%s\n' "$IMAGE" > "$REPORT/image-id.txt"
cleanup() {
 local status=$?
 podman exec "$NAME" journalctl --no-pager > "$REPORT/journal.log" 2>&1 || true
 podman logs "$NAME" > "$REPORT/container.log" 2>&1 || true
 podman stop --time 10 "$NAME" > "$REPORT/stop.log" 2>&1 || true
 printf '%s\n' "$status" > "$REPORT/exit-code.txt"
}
podman run --detach --tty --pull=never --name "$NAME" --hostname c01-prerequisite-qualification \
 --network=none --cgroupns=private --systemd=always \
 --security-opt=unmask=ALL \
 --cap-add=SYS_ADMIN --cap-add=SYS_PTRACE --cap-add=NET_ADMIN \
 --memory=2g --cpus=2 --pids-limit=512 --tmpfs /run --tmpfs /tmp \
 --entrypoint /sbin/init "$IMAGE" --unit=basic.target --log-target=console > "$REPORT/container-id.txt"
trap cleanup EXIT
podman exec "$NAME" install -d /opt/c01-fixture/image-recipe /opt/c01-fixture/tests/regression
podman cp "$ROOT/scripts" "$NAME:/opt/c01-fixture/scripts"
podman cp "$ROOT/image-recipe/configs" "$NAME:/opt/c01-fixture/image-recipe/configs"
podman cp "$ROOT/tests/regression/c01-prerequisite-systemd.py" "$NAME:/opt/c01-fixture/tests/regression/c01-prerequisite-systemd.py"
podman exec "$NAME" chown -R root:root /opt/c01-fixture
podman cp "$REPORT/tmux-runtime.tar" "$NAME:/opt/c01-fixture/tmux-runtime.tar"
podman exec --workdir /opt/c01-fixture "$NAME" sha256sum "${sources[@]}" > "$REPORT/container-source-sha256.txt"
cmp "$REPORT/source-sha256.txt" "$REPORT/container-source-sha256.txt"
podman exec --env C01_DISPOSABLE_SYSTEMD=1 "$NAME" python3 -B \
 /opt/c01-fixture/tests/regression/c01-prerequisite-systemd.py 2>&1 | tee "$REPORT/test.log"
sha256sum --check "$REPORT/source-sha256.txt" > "$REPORT/source-unchanged.txt"
podman cp "$NAME:/var/lib/c01-fixture/receipts" "$REPORT/fixture-receipts"