#!/usr/bin/env bash
# Fail-closed checks for the build guardrails, without root or ARM hardware.
source "$(dirname -- "${BASH_SOURCE[0]}")/../../tools/lib.sh"
cd "$FDS_ROOT"
expect_failure() {
    local label=$1
    shift
    if "$@" >"$scratch/rejection.log" 2>&1; then
        die "Validation incorrectly accepted: $label"
    fi
    printf 'PASS: rejects %s\n' "$label"
}
scratch=$(mktemp -d)
trap 'rm -rf -- "$scratch"' EXIT
for script in tools/* tests/integration/m0-checks; do
    [[ -f $script ]] || continue
    [[ $(head -n 1 "$script") == '#!/usr/bin/env bash' ]] || continue
    bash -n "$script"
done
tools/verify-elf target/aarch64-unknown-linux-musl/release/fds-smoketest aarch64 static
expect_failure 'static musl executable as a glibc package' tools/verify-elf \
    target/aarch64-unknown-linux-musl/release/fds-smoketest aarch64 glibc
expect_failure 'wrong target architecture' tools/verify-elf /bin/bash aarch64 static
expect_failure 'dynamic host executable as static' tools/verify-elf /bin/bash x86_64 static
expect_failure 'non-ELF input' tools/verify-elf README.md aarch64 static
expect_failure 'missing artifact' tools/verify-elf "$scratch/missing" aarch64 static
expect_failure 'unknown linkage mode' tools/verify-elf /bin/bash x86_64 unknown
expect_failure 'invalid package path' tools/build-package ../hello
expect_failure 'unsupported bootstrap option' tools/bootstrap-host --unknown

# Use a disposable minimal checkout to exercise pin and dirty-tree detection.
mkdir -p "$scratch/repo/tools" "$scratch/repo/vendor/void-packages"
cp tools/lib.sh tools/prepare-void "$scratch/repo/tools/"
fake="$scratch/repo/vendor/void-packages"
git -C "$fake" init -q
printf '# fixture\n' >"$fake/xbps-src"
mkdir -p "$fake/srcpkgs/fds-upstream" "$fake/etc" "$scratch/repo/config" "$scratch/repo/packages/fds-fixture"
printf '# upstream\n' >"$fake/srcpkgs/fds-upstream/template"
printf 'etc/conf\n' >"$fake/.gitignore"
cp config/xbps-src.conf "$scratch/repo/config/"
printf '# inert overlay fixture\n' >"$scratch/repo/packages/fds-fixture/template"
git -C "$fake" add .
git -C "$fake" -c user.name=FDS -c user.email=test@example.invalid commit -qm fixture
git -C "$fake" rev-parse HEAD >"$scratch/repo/VOID_PACKAGES_COMMIT"
bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
printf 'PASS: accepts exact clean Void commit\n'
"$scratch/repo/tools/prepare-void"
cmp "$scratch/repo/packages/fds-fixture/template" "$fake/srcpkgs/fds-fixture/template"
"$scratch/repo/tools/prepare-void"
printf 'PASS: overlay copied and repeat preparation is idempotent\n'
printf '# changed\n' >>"$scratch/repo/packages/fds-fixture/template"
expect_failure 'stale generated overlay' "$scratch/repo/tools/prepare-void"
cp "$fake/srcpkgs/fds-fixture/template" "$scratch/repo/packages/fds-fixture/template"
mkdir -p "$scratch/repo/packages/fds-upstream"
printf '# collision\n' >"$scratch/repo/packages/fds-upstream/template"
expect_failure 'overlay replacing upstream package' "$scratch/repo/tools/prepare-void"
printf '# changed config\n' >>"$fake/etc/conf"
expect_failure 'overwriting local xbps configuration' "$scratch/repo/tools/prepare-void"
printf '\n# dirty\n' >>"$fake/xbps-src"
expect_failure 'modified Void source' bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
printf '%040d\n' 0 >"$scratch/repo/VOID_PACKAGES_COMMIT"
expect_failure 'wrong Void commit' bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
printf 'PASS: M0 guardrail checks complete\n'