#!/bin/sh

set -eu

UV_VERSION=0.12.2

APPDIR=/usr/share/rekono
STAMP="${REKONO_HOME}/.bootstrap-stamp"

version="$(dpkg-query --showformat='${Version}' --show rekono 2>/dev/null || echo unknown)"

if [ -r "${STAMP}" ] && [ "$(cat "${STAMP}")" = "${version}" ] && [ -x "${REKONO_HOME}/venv/bin/python" ]; then
    echo "Rekono environment is already up to date."
    exit 0
fi

uv_target() {
    case "$(uname -m)" in
        x86_64)         echo x86_64-unknown-linux-gnu ;;
        aarch64|arm64)  echo aarch64-unknown-linux-gnu ;;
        armv7l)         echo armv7-unknown-linux-gnueabihf ;;
        i686|i386)      echo i686-unknown-linux-gnu ;;
        *)              echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;;
    esac
}

install_uv() {
    target="$(uv_target)"
    archive="uv-${target}.tar.gz"
    url="https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/${archive}"
    workdir="$(mktemp -d)"
    trap 'rm -rf "${workdir}"' EXIT

    echo "Downloading uv ${UV_VERSION} for ${target}"
    curl --silent --show-error --fail --location --output "${workdir}/${archive}" "${url}"

    grep " ${archive}\$" "${APPDIR}/uv.sha256" > "${workdir}/expected.sha256"
    if [ ! -s "${workdir}/expected.sha256" ]; then
        echo "No checksum recorded for ${archive}" >&2
        exit 1
    fi
    ( cd "${workdir}" && sha256sum --check --status expected.sha256 ) || {
        echo "Checksum verification failed for ${archive}" >&2
        exit 1
    }

    tar -xzf "${workdir}/${archive}" -C "${workdir}"
    mkdir -p "${REKONO_HOME}/bin"
    install -m 0755 "${workdir}/uv-${target}/uv" "${UV}"
}

if [ ! -x "${UV}" ] || ! "${UV}" --version 2>/dev/null | grep -q "${UV_VERSION}"; then
    install_uv
fi


echo "Installing Python dependencies"
"${UV}" sync --no-dev --locked --managed-python

printf '%s\n' "${version}" > "${STAMP}"
echo "Rekono environment is ready."
