#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TARGET_IMAGE="${1:-geointel-ci:local}"
OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"

case "$OUTPUT" in
  /*|*..*)
    echo "SBOM output must be a repository-relative path without '..'." >&2
    exit 1
    ;;
esac
case "$IMAGE_ARCHIVE" in
  /*|*..*)
    echo "Image archive must be a repository-relative path without '..'." >&2
    exit 1
    ;;
esac

docker image inspect "$TARGET_IMAGE" >/dev/null
mkdir -p "$ROOT/$(dirname "$OUTPUT")"
if [[ ! -s "$ROOT/$IMAGE_ARCHIVE" ]]; then
  mkdir -p "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
  docker save "$TARGET_IMAGE" --output "$ROOT/$IMAGE_ARCHIVE"
fi
WORKDIR="/workspace"
WORKSPACE_ARGS=(-v "$ROOT:/workspace")
if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
  WORKDIR="$ROOT"
  WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
fi
docker run --rm \
  "${WORKSPACE_ARGS[@]}" \
  -w "$WORKDIR" \
  "$SYFT_IMAGE" \
  "docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
  -o "spdx-json=$OUTPUT"

test -s "$ROOT/$OUTPUT"
echo "SBOM written to $OUTPUT"