#!/usr/bin/env bash
# verify-bootstrap.sh — Verifies a bootstrap archive before publishing
# Usage: ./verify-bootstrap.sh /path/to/archive.tar.gz

set -euo pipefail

ARCHIVE="${1:?Usage: $0 /path/to/archive.tar.gz}"

echo "=== Bootstrap Archive Verifier ==="
echo "File: $ARCHIVE"
echo ""

# Check file exists
if [ ! -f "$ARCHIVE" ]; then
    echo "ERROR: File not found"
    exit 1
fi

# File size
SIZE=$(du -sh "$ARCHIVE" | cut -f1)
echo "Size: $SIZE"

# SHA256
SHA256=$(sha256sum "$ARCHIVE" | cut -d' ' -f1)
echo "SHA256: $SHA256"
echo ""

# Check it's a valid gzip file
if file "$ARCHIVE" | grep -q "gzip compressed"; then
    echo "Format: Valid gzip (.tar.gz) ✅"
else
    echo "Format: WARNING — not a gzip file!"
fi

# List contents without extracting
echo ""
echo "Archive contents:"
tar -tzvf "$ARCHIVE" 2>/dev/null | head -20 || echo "WARNING: Could not list contents"

# Check for dangerous files
echo ""
echo "Security checks:"
if tar -tzf "$ARCHIVE" 2>/dev/null | grep -q "wallet.dat"; then
    echo "  ❌ DANGER: wallet.dat found in archive!"
else
    echo "  ✅ No wallet.dat found"
fi

if tar -tzf "$ARCHIVE" 2>/dev/null | grep -q "peers.dat"; then
    echo "  ⚠️  peers.dat found (will be rediscovered — acceptable)"
else
    echo "  ✅ No peers.dat found"
fi

if tar -tzf "$ARCHIVE" 2>/dev/null | grep -q "debug.log"; then
    echo "  ⚠️  debug.log found (should be excluded)"
else
    echo "  ✅ No debug.log found"
fi

# Check blk0001.dat size
BLK_SIZE=$(tar -xzf "$ARCHIVE" -C /tmp --wildcards "blk0001.dat" --to-command="du -h" 2>/dev/null | cut -f1 || echo "NOT FOUND")
echo ""
echo "blk0001.dat size: $BLK_SIZE"
if [ "$BLK_SIZE" = "NOT FOUND" ]; then
    echo "  ❌ blk0001.dat not found in archive!"
elif [ "$(echo "$BLK_SIZE" | tr -d 'MGT' | cut -d. -f1)" -lt 100 ]; then
    echo "  ⚠️  blk0001.dat suspiciously small — check it"
else
    echo "  ✅ blk0001.dat size OK"
fi

echo ""
echo "SHA256 for reference:"
echo "$SHA256"