#!/usr/bin/env bash
# Run inside a restored tree with private Cargo/Rustup caches and no network.
source "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"
(( $# > 0 )) || die 'Usage: tools/in-frozen-build COMMAND [ARGUMENT...]'
[[ -f $FDS_ROOT/.host/frozen/lock.json ]] || die 'Use tools/frozen-inputs restore first'
(( EUID != 0 )) || die 'Run as an ordinary user'
export CARGO_HOME="$FDS_ROOT/.host/repro-cargo"
export RUSTUP_HOME="$FDS_ROOT/.host/repro-rustup"
export FDS_OFFLINE=1
export CARGO_NET_OFFLINE=true
check_void_pin
rust_bin=$(dirname -- "$(rustup which rustc)")
# Keep the workstation read-only; all writable caches and output stay in the
# restored tree. Network isolation covers xbps-src and every nested child too.
exec bwrap --unshare-user --unshare-net --ro-bind / / --bind "$FDS_ROOT" "$FDS_ROOT" \
    --tmpfs /tmp --dev /dev --proc /proc \
    --setenv PATH "$rust_bin:$PATH" --chdir "$FDS_ROOT" "$@"