#!/bin/bash
# Publish the built tarball to asger.weirsoe.dk, which is what the AUR PKGBUILD
# downloads from.
#
#   TARBALL_SSH_KEY   private key authorised on the web host       (required)
#   TARBALL_HOST      web host to upload to over SSH              (required)
#   TARBALL_PATH      directory on that host                       (required)
#   KEEP_RELEASES     how many tarballs to retain (default 3)
#   $1                path to the tarball to upload
#
# TARBALL_PATH is deliberately outside the website's own web root: the site
# deploy replaces its web root atomically, so anything stored inside it would
# disappear on the next deploy. The web server publishes the directory through
# a separate /tarballz/ location.

set -euo pipefail

TARBALL="${1:?path to tarball is required}"
: "${TARBALL_SSH_KEY:?TARBALL_SSH_KEY is required}"
: "${TARBALL_HOST:?TARBALL_HOST is required}"
: "${TARBALL_PATH:?TARBALL_PATH is required}"
KEEP_RELEASES="${KEEP_RELEASES:-3}"

name="$(basename "$TARBALL")"

mkdir -p ~/.ssh
printf '%s\n' "$TARBALL_SSH_KEY" > ~/.ssh/tarball_key
chmod 600 ~/.ssh/tarball_key
ssh-keyscan -t ed25519 "$TARBALL_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
SSH=(ssh -i "$HOME/.ssh/tarball_key" -o StrictHostKeyChecking=accept-new)

echo ":: uploading ${name} ($(du -h "$TARBALL" | cut -f1)) to ${TARBALL_HOST}:${TARBALL_PATH}"

# Upload to a temporary name and rename on arrival, so a download that starts
# mid-transfer can never see a truncated file at the final URL.
"${SSH[@]}" "root@${TARBALL_HOST}" "mkdir -p '${TARBALL_PATH}'"
"${SSH[@]}" "root@${TARBALL_HOST}" "cat > '${TARBALL_PATH}/.${name}.part'" < "$TARBALL"
"${SSH[@]}" "root@${TARBALL_HOST}" "mv '${TARBALL_PATH}/.${name}.part' '${TARBALL_PATH}/${name}' && chmod 644 '${TARBALL_PATH}/${name}'"

echo ":: verifying the uploaded copy matches"
local_sum="$(sha256sum "$TARBALL" | awk '{print $1}')"
remote_sum="$("${SSH[@]}" "root@${TARBALL_HOST}" "sha256sum '${TARBALL_PATH}/${name}'" | awk '{print $1}')"
if [[ "$local_sum" != "$remote_sum" ]]; then
  echo "error: checksum mismatch after upload" >&2
  echo "  local  $local_sum" >&2
  echo "  remote $remote_sum" >&2
  exit 1
fi
echo ":: sha256 matches ($local_sum)"

# Old releases are kept so that a user mid-install of the previous version is
# not left with a dead URL, but not forever - each one is well over a gigabyte.
echo ":: pruning to the newest ${KEEP_RELEASES} tarballs"
"${SSH[@]}" "root@${TARBALL_HOST}" "
  cd '${TARBALL_PATH}' || exit 0
  ls -1t jasp-desktop-*.tar.zst 2>/dev/null | tail -n +\$((${KEEP_RELEASES} + 1)) | while read -r old; do
    echo \"   removing \$old\"
    rm -f -- \"\$old\"
  done
  echo '   remaining:'
  ls -1sh jasp-desktop-*.tar.zst 2>/dev/null | sed 's/^/     /'
"

echo ":: published"