library-bundle

#!/usr/bin/env bash

# Deterministic validation and directory-bundle tooling for the one-file
# library boundary. This script never concatenates or rewrites a library.

repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)" || exit 1

usage() {
    cat >&2 << 'EOF'
Usage:
  scripts/library-bundle check
  scripts/library-bundle bundle DIRECTORY
  scripts/library-bundle verify DIRECTORY
EOF
}

error() {
    printf 'Library bundle error: %s\n' "$*" >&2
}

hash_file() {
    local path="$1"
    if command -v sha256sum > /dev/null 2>&1; then
        sha256sum -- "$path" | awk '{print $1}'
    else
        shasum -a 256 -- "$path" | awk '{print $1}'
    fi
}

file_list() {
    local manifest

    manifest="$("$repo_root/scripts/api-manifest" artifact-paths)" || return $?
    {
        printf '%s\n' VERSION base_api_manifest.yaml
        printf '%s\n' "$manifest"
    } | LC_ALL=C sort -u
}

bundle_inventory() {
    local inventory

    inventory="$(file_list)" || return $?
    {
        printf '%s\n' BUNDLE.release
        printf '%s\n' "$inventory"
    } | LC_ALL=C sort -u
}

check_one_file_boundary() {
    local source_path directory count source_paths
    source_paths="$("$repo_root/scripts/api-manifest" source-paths)" || return $?
    while IFS= read -r source_path; do
        [[ "$source_path" == lib/bash/*/lib_*.sh ]] || continue
        directory="${source_path%/*}"
        count="$(find "$repo_root/$directory" -maxdepth 1 -type f -name 'lib_*.sh' -print | wc -l | tr -d '[:space:]')"
        if [[ "$count" != 1 ]]; then
            error "public library directory '$directory' has $count canonical lib_*.sh files (expected exactly one)"
            return 1
        fi
        if grep -Eq '^[[:space:]]*(source[[:space:]]+|\.[[:space:]]+[^|])' "$repo_root/$source_path"; then
            error "public library '$source_path' contains a source-time implementation import"
            return 1
        fi
    done <<< "$source_paths"
}

check_repo() {
    local inventory

    "$repo_root/scripts/api-manifest" check > /dev/null || return $?
    check_one_file_boundary || return $?
    inventory="$(file_list)" || return $?
    while IFS= read -r path; do
        [[ -n "$path" && -f "$repo_root/$path" ]] || {
            error "manifest artifact is missing: $path"
            return 1
        }
    done <<< "$inventory"
    printf 'Library bundle contract is valid: one canonical file per public library.\n'
}

write_hash_manifest() {
    local root="$1" path inventory
    inventory="$(bundle_inventory)" || return $?
    : > "$root/MANIFEST.sha256" || return 1
    while IFS= read -r path; do
        [[ -n "$path" ]] || continue
        printf '%s  %s\n' "$(hash_file "$root/$path")" "$path" >> "$root/MANIFEST.sha256" || return 1
    done <<< "$inventory"
}

bundle_repo() {
    local destination="${1:-}" temporary path inventory inventory_status

    [[ -n "$destination" ]] || {
        usage
        return 2
    }
    check_repo || return $?
    [[ ! -e "$destination" && ! -L "$destination" ]] || {
        error "refusing to overwrite existing bundle '$destination'"
        return 2
    }
    temporary="$(mktemp -d "${destination}.tmp.XXXXXX")" || {
        error "unable to create a private staging directory beside '$destination'"
        return 1
    }
    inventory="$(file_list)" || {
        inventory_status=$?
        rm -rf -- "$temporary"
        return "$inventory_status"
    }
    while IFS= read -r path; do
        [[ -n "$path" ]] || continue
        if ! mkdir -p "$temporary/$(dirname -- "$path")" ||
            ! cp -- "$repo_root/$path" "$temporary/$path"; then
            rm -rf -- "$temporary"
            return 1
        fi
    done <<< "$inventory"
    if ! mkdir -p "$temporary/lib/bash"; then
        rm -rf -- "$temporary"
        return 1
    fi
    if [[ -r "$repo_root/lib/bash/base-bash-libs.release" ]]; then
        if ! cp -- "$repo_root/lib/bash/base-bash-libs.release" "$temporary/lib/bash/base-bash-libs.release"; then
            rm -rf -- "$temporary"
            return 1
        fi
    fi
    printf 'bundle_format=1\nsource_version=%s\nsource_commit=%s\nprovenance=deterministic-directory-bundle\n' \
        "$(< "$repo_root/VERSION")" \
        "$(sed -n 's/^commit=//p' "$repo_root/lib/bash/base-bash-libs.release" | sed -n '1p')" \
        > "$temporary/BUNDLE.release" || {
        rm -rf -- "$temporary"
        return 1
    }
    if ! write_hash_manifest "$temporary"; then
        rm -rf -- "$temporary"
        return 1
    fi
    if ! mv -- "$temporary" "$destination"; then
        rm -rf -- "$temporary"
        return 1
    fi
    printf 'Created deterministic bundle: %s\n' "$destination"
}

verify_bundle() {
    local root="${1:-}" expected actual path line line_number=0
    local checksum_pattern inventory
    local -A checksum_seen=() expected_seen=()

    [[ -n "$root" && -d "$root" && ! -L "$root" && -f "$root/MANIFEST.sha256" &&
        ! -L "$root/MANIFEST.sha256" && -f "$root/BUNDLE.release" && ! -L "$root/BUNDLE.release" ]] || {
        error "bundle is missing MANIFEST.sha256: $root"
        return 1
    }
    inventory="$(bundle_inventory)" || return $?
    checksum_pattern='^([0-9a-f]{64})  ([A-Za-z0-9_./-]+)$'
    while IFS= read -r line || [[ -n "$line" ]]; do
        line_number=$((line_number + 1))
        [[ "$line" =~ $checksum_pattern ]] || {
            error "malformed checksum entry at line $line_number"
            return 1
        }
        expected="${BASH_REMATCH[1]}"
        path="${BASH_REMATCH[2]}"
        [[ "$path" != /* && "$path" != ./* && "$path" != */ && "$path" != *'//'* &&
            "$path" != *'/../'* && "$path" != ../* && "$path" != *'/./'* && "$path" != ./ ]] || {
            error "unsafe checksum path: $path"
            return 1
        }
        [[ -z "${checksum_seen[$path]+set}" ]] || {
            error "duplicate checksum entry: $path"
            return 1
        }
        checksum_seen["$path"]=1
        [[ -f "$root/$path" ]] || {
            error "bundle file is missing: $path"
            return 1
        }
        [[ ! -L "$root/$path" ]] || {
            error "bundle file must not be a symlink: $path"
            return 1
        }
        actual="$(hash_file "$root/$path")"
        [[ "$actual" == "$expected" ]] || {
            error "bundle hash mismatch: $path"
            return 1
        }
    done < "$root/MANIFEST.sha256"

    while IFS= read -r path; do
        [[ -n "$path" ]] || continue
        expected_seen["$path"]=1
        [[ -n "${checksum_seen[$path]+set}" ]] || {
            error "bundle checksum manifest omits expected file: $path"
            return 1
        }
    done <<< "$inventory"
    for path in "${!checksum_seen[@]}"; do
        [[ -n "${expected_seen[$path]+set}" ]] || {
            error "bundle checksum manifest contains unexpected file: $path"
            return 1
        }
    done

    # Reject symlink payloads and regular files not represented by the exact
    # inventory. A vendor destination may additionally carry its lock file.
    while IFS= read -r path; do
        path="${path#./}"
        [[ "$path" == MANIFEST.sha256 ]] && continue
        [[ "$path" == base-bash-libs.lock && "${BUNDLE_VERIFY_ALLOW_LOCK:-0}" == 1 ]] && continue
        [[ -n "${expected_seen[$path]+set}" ]] || {
            error "bundle contains unexpected file: $path"
            return 1
        }
    done < <(cd -- "$root" && find . -type f -print | LC_ALL=C sort)
    if find "$root" -type l -print -quit | grep -q .; then
        error 'bundle contains a symlink payload'
        return 1
    fi

    local metadata_key metadata_value metadata_line metadata_line_count=0
    local -A metadata_seen=()
    while IFS= read -r metadata_line || [[ -n "$metadata_line" ]]; do
        metadata_line_count=$((metadata_line_count + 1))
        [[ "$metadata_line" =~ ^([a-z_][a-z_]*)=([^[:space:]]+)$ ]] || {
            error "malformed BUNDLE.release field at line $metadata_line_count"
            return 1
        }
        metadata_key="${BASH_REMATCH[1]}"
        metadata_value="${BASH_REMATCH[2]}"
        [[ -z "${metadata_seen[$metadata_key]+set}" ]] || {
            error "duplicate BUNDLE.release field: $metadata_key"
            return 1
        }
        metadata_seen["$metadata_key"]=1
        case "$metadata_key" in
        bundle_format) [[ "$metadata_value" == 1 ]] || {
            error 'unsupported bundle format'
            return 1
        } ;;
        source_version) [[ "$metadata_value" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9.-]+)?$ ]] || {
            error 'invalid source version metadata'
            return 1
        } ;;
        source_commit) [[ "$metadata_value" =~ ^(unknown|[0-9a-f]{40})$ ]] || {
            error 'invalid source commit metadata'
            return 1
        } ;;
        provenance) [[ "$metadata_value" == deterministic-directory-bundle || "$metadata_value" == release-artifact ]] || {
            error 'invalid provenance metadata'
            return 1
        } ;;
        *)
            error "unknown BUNDLE.release field: $metadata_key"
            return 1
            ;;
        esac
    done < "$root/BUNDLE.release"
    ((metadata_line_count == 4)) || {
        error 'BUNDLE.release must contain exactly four metadata fields'
        return 1
    }
    printf 'Bundle provenance and hashes are valid: %s\n' "$root"
}

main() {
    case "${1:-}" in
    check)
        (($# == 1)) || {
            usage
            return 2
        }
        check_repo
        ;;
    bundle)
        (($# == 2)) || {
            usage
            return 2
        }
        bundle_repo "$2"
        ;;
    verify)
        (($# == 2)) || {
            usage
            return 2
        }
        verify_bundle "$2"
        ;;
    *)
        usage
        return 2
        ;;
    esac
}

main "$@"