#!/bin/sh
set -eu

repo="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
output="$repo/deploy/security"
mkdir -p "$output"

application_image="${1:-${LUDARIUM_IMAGE:-ludarium/ludarium:0.4.1}}"
release_version="${LUDARIUM_RELEASE_VERSION:-${application_image##*:}}"
cache="${LUDARIUM_RELEASE_TOOL_CACHE:-/mnt/user/appdata/ludarium/release-tools}"
mkdir -p "$cache/bin" "$cache/downloads" "$cache/grype-db" "$cache/tmp"
TMPDIR="$cache/tmp"
export TMPDIR

scan_source="docker:$application_image"
image_archive=""
if [ -n "${WSL_INTEROP:-}" ] \
  && command -v docker.exe >/dev/null 2>&1 \
  && docker.exe image inspect "$application_image" >/dev/null 2>&1 \
  && ! docker image inspect "$application_image" >/dev/null 2>&1; then
  image_archive="$(mktemp "$cache/tmp/ludarium-image.XXXXXX.tar")"
  trap 'rm -f "$image_archive"' EXIT HUP INT TERM
  docker.exe save --output "$(wslpath -w "$image_archive")" "$application_image"
  scan_source="docker-archive:$image_archive"
fi

download_tool() {
  name="$1" version="$2" archive="$3" checksum="$4" url="$5"
  binary="$cache/bin/$name-$version"
  [ -x "$binary" ] && { printf '%s\n' "$binary"; return; }
  package="$cache/downloads/$archive"
  if [ ! -f "$package" ] || ! printf '%s  %s\n' "$checksum" "$package" | sha256sum -c - >/dev/null 2>&1; then
    rm -f "$package.part"
    curl --fail --location --silent --show-error --retry 5 --retry-all-errors \
      --connect-timeout 15 --max-time 300 "$url" -o "$package.part"
    printf '%s  %s\n' "$checksum" "$package.part" | sha256sum -c - >/dev/null
    mv "$package.part" "$package"
  fi
  work="$(mktemp -d)"
  tar -xzf "$package" -C "$work" "$name"
  install -m 0755 "$work/$name" "$binary"
  rm -rf "$work"
  printf '%s\n' "$binary"
}

gitleaks="$(download_tool gitleaks 8.30.1 gitleaks_8.30.1_linux_x64.tar.gz \
  551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb \
  https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz)"
syft="$(download_tool syft 1.50.0 syft_1.50.0_linux_amd64.tar.gz \
  bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788 \
  https://github.com/anchore/syft/releases/download/v1.50.0/syft_1.50.0_linux_amd64.tar.gz)"
grype="$(download_tool grype 0.116.1 grype_0.116.1_linux_amd64.tar.gz \
  0122df7b655981abe547ad3d2190d65551dac6a2bfc80b4dc2a989b5d0587458 \
  https://github.com/anchore/grype/releases/download/v0.116.1/grype_0.116.1_linux_amd64.tar.gz)"

# Scan the materialized candidate tree. A linked Git worktree can reference metadata
# outside /repo, which would otherwise make a containerized history scan inspect zero commits.
"$gitleaks" dir "$repo" --config "$repo/.gitleaks.toml" --redact --report-format json --report-path "$output/gitleaks.json"
"$syft" "$scan_source" -o "cyclonedx-json=$output/ludarium-$release_version.cdx.json"
if command -v timeout >/dev/null; then
  timeout 600 env GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" db update
  timeout 600 env GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" "$scan_source" -o json --file "$output/grype.json" --fail-on high
else
  GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" db update
  GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" "$scan_source" -o json --file "$output/grype.json" --fail-on high
fi

printf 'security gates passed for %s\n' "$application_image"