#!/usr/bin/env python3
"""Guest-only real Debian baseline and authenticated upgrade package acquisition."""
import hashlib
import json
import os
from pathlib import Path
import subprocess

assert 'QEMU' in Path('/sys/class/dmi/id/sys_vendor').read_text()
assert subprocess.check_output(['findmnt', '-n', '-o', 'SOURCE', '/'], text=True).strip() == '/dev/vda'
os.environ['DEBIAN_FRONTEND'] = 'noninteractive'

def run(*args):
    print('COMMAND', args, flush=True)
    result = subprocess.run(args, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
    print(result.stdout, flush=True)
    result.check_returncode()
    return result.stdout

def digest(path):
    with path.open('rb') as f:
        return hashlib.file_digest(f, 'sha256').hexdigest()

evidence = Path('/var/log/os-ota-baseline')
evidence.mkdir(exist_ok=False)
canaries = Path('/var/lib/archipelago/ota-synthetic-canaries')
before = {p.name: digest(p) for p in canaries.iterdir()}
print(run('apt-get', 'update'))
run('apt-get', '-y', '--no-install-recommends', 'install',
    'linux-image-6.12.107+deb13-amd64=6.12.107-1',
    'curl=8.14.1-2+deb13u5', 'libcurl4t64=8.14.1-2+deb13u5',
    'initramfs-tools', 'grub-pc-bin', 'grub2-common')
Path('/etc/initramfs-tools/conf.d/resume').write_text('RESUME=none\n')
run('update-initramfs', '-u', '-k', '6.12.107+deb13-amd64')
Path('/boot/grub').mkdir(exist_ok=True)
run('update-grub')
run('apt-get', '-y', '--download-only', '--no-install-recommends', 'install',
    'linux-image-6.12.113+deb13-amd64=6.12.113-1',
    'curl=8.14.1-2+deb13u7', 'libcurl4t64=8.14.1-2+deb13u7')
packages = []
for path in sorted(Path('/var/cache/apt/archives').glob('*.deb')):
    fields = run('dpkg-deb', '-f', str(path), 'Package', 'Version', 'Architecture')
    packages.append({'file': str(path), 'sha256': digest(path), 'size': path.stat().st_size, 'fields': fields})
    (evidence/(path.name+'.apt-metadata')).write_text(run('apt-cache', 'show', path.name.split('_')[0]))
after = {p.name: digest(p) for p in canaries.iterdir()}
assert before == after
receipt = {'baseline_kernel': '6.12.107+deb13-amd64', 'target_kernel': '6.12.113+deb13-amd64',
           'packages': packages, 'canaries': before,
           'qualification': 'authenticated-package-acquisition-only-not-D09-OTA'}
(evidence/'receipt.json').write_text(json.dumps(receipt, indent=2)+'\n')
print(json.dumps(receipt, indent=2))
print('BASELINE_APT_PREPARED_NO_OTA_PASS')