import fs from 'node:fs/promises';
import path from 'node:path';
import {fileURLToPath} from 'node:url';
import {createHash} from 'node:crypto';

const here = path.dirname(fileURLToPath(import.meta.url));
const target = path.resolve(process.argv[2] || 'output/security-go-build');
await fs.mkdir(target, {recursive:true});
const pins = JSON.parse(await fs.readFile(path.join(here, 'go-sources.json')));
const checks = [];
for (const pin of pins) {
  const file = path.join(target, pin.name + '.tar.gz');
  let bytes;
  try { bytes = await fs.readFile(file); } catch (error) {
    if (error.code !== 'ENOENT') throw error;
    const response = await fetch(`https://codeload.github.com/${pin.repo}/tar.gz/${pin.commit}`);
    if (!response.ok) throw Error(`Source download: ${pin.name} HTTP ${response.status}`);
    bytes = Buffer.from(await response.arrayBuffer());
    if (createHash('sha256').update(bytes).digest('hex') !== pin.sha256) throw Error(`Source checksum: ${pin.name}`);
    await fs.writeFile(file, bytes, {flag:'wx'});
  }
  if (createHash('sha256').update(bytes).digest('hex') !== pin.sha256) throw Error(`Source checksum: ${pin.name}`);
  checks.push(`${pin.sha256}  ${pin.name}.tar.gz`);
}
await fs.writeFile(path.join(target, 'sources.sha256'), checks.join('\n') + '\n');
for (const [from,to] of [['go-rebuild.Dockerfile','Dockerfile'],['tls-probe.go','tls-probe.go']]) {
  await fs.copyFile(path.join(here, from), path.join(target,to));
}
console.log(JSON.stringify({target, sourcesVerified:pins.length, go:'1.26.10'}));