#!/bin/bash
#
# Copyright (C) 2018 Red Hat, Inc.
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the
# Free Software Foundation, Inc., 59 Temple Place - Suite 330,
# Boston, MA 02111-1307, USA.

set -euo pipefail

. $(dirname $0)/libtest.sh

skip_without_bwrap

# Start the fake registry server

if [ x${USE_HTTPS} = xyes ] ; then
    cat > openssl.config <<EOF
[req]
distinguished_name=default_dn

[v3_ca]
basicConstraints=critical,CA:TRUE,pathlen:0

[server_cert]
basicConstraints=CA:FALSE
subjectAltName=DNS:registry.example.com,IP:127.0.0.1

[usr_cert]
subjectAltName=email:copy
basicConstraints=CA:FALSE
keyUsage=digitalSignature
extendedKeyUsage=clientAuth

[default_dn]
CN=Unused
EOF

    openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 \
        -nodes -keyout example.com.ca.key -out example.com.ca.crt \
        -subj="/CN=Example CA/O=example.com/emailAddress=nomail@example.com" \
        -config openssl.config -extensions v3_ca

    openssl req -newkey rsa:4096 -sha256 \
        -nodes -keyout example.com.key -out example.com.csr \
	-subj "/CN=registry.example.com"

    openssl x509 -req -in example.com.csr -days 3650 \
        -CA example.com.ca.crt -CAkey example.com.ca.key -CAcreateserial \
	-extfile openssl.config -extensions server_cert \
	-out example.com.crt

    openssl req -newkey rsa:4096 -sha256 \
        -nodes -keyout client.key -out client.csr \
        -subj="/CN=User/O=example.com/emailAddress=user@example.com"

    openssl x509 -req -in client.csr -days 3650 \
	-CA example.com.ca.crt -CAkey example.com.ca.key -CAcreateserial \
	-extfile openssl.config -extensions usr_cert \
	-out client.cert

    server_args="--cert=example.com.crt --key=example.com.key --mtls-cacert=example.com.ca.crt"
else
    server_args=
    client_args=
fi

httpd oci-registry-server.py --dir=. $server_args
port=$(cat httpd-port)

if [ x${USE_HTTPS} = xyes ] ; then
    scheme=https
    client_args="--cert=client.cert --key=client.key --cacert=example.com.ca.crt"

    hostdir=$FLATPAK_SYSTEM_CERTS_D/127.0.0.1:${port}
    mkdir -p $hostdir
    cp example.com.ca.crt client.key client.cert $hostdir
else
    scheme=http
    client_args=
fi

client="python3 $test_srcdir/oci-registry-client.py $client_args --url=${scheme}://127.0.0.1:${port}"

setup_repo_no_add oci

# Add OCI bundles to it

${FLATPAK} build-bundle --runtime --oci $FL_GPGARGS repos/oci oci/platform-image org.test.Platform >&2
$client add platform latest $(pwd)/oci/platform-image

${FLATPAK} build-bundle --oci $FL_GPGARGS repos/oci oci/app-image org.test.Hello >&2
$client add hello latest $(pwd)/oci/app-image

# Add an OCI remote

${FLATPAK} remote-add ${U} oci-registry "oci+${scheme}://127.0.0.1:${port}" >&2

# Check that the images we expect are listed

images=$(${FLATPAK} remote-ls ${U} --columns=app oci-registry | sort | tr '\n' ' ' | sed 's/ $//')
assert_streq "$images" "org.test.Hello org.test.Platform"
ok "list remote"

# Pull appstream data

${FLATPAK} update ${U} --appstream oci-registry >&2

# Check that the appstream and icons exist

if [ x${USE_SYSTEMDIR-} == xyes ] ; then
    appstream=$SYSTEMDIR/appstream/oci-registry/$ARCH/appstream.xml.gz
    icondir=$SYSTEMDIR/appstream/oci-registry/$ARCH/icons
else
    appstream=$USERDIR/appstream/oci-registry/$ARCH/appstream.xml.gz
    icondir=$USERDIR/appstream/oci-registry/$ARCH/icons
fi

gunzip -c $appstream > appstream-uncompressed
assert_file_has_content appstream-uncompressed '<id>org\.test\.Hello\.desktop</id>'
assert_has_file $icondir/64x64/org.test.Hello.png

ok "appstream"

# Test that 'flatpak search' works
${FLATPAK} search org.test.Hello > search-results
assert_file_has_content search-results "Print a greeting"

ok "search"

# Replace with the app image with detached icons, check that the icons work

old_icon_hash=(md5sum $icondir/64x64/org.test.Hello.png)
rm $icondir/64x64/org.test.Hello.png
$client delete hello latest
$client  add --detach-icons hello latest $(pwd)/oci/app-image
${FLATPAK} update ${U} --appstream oci-registry >&2
assert_has_file $icondir/64x64/org.test.Hello.png
new_icon_hash=(md5sum $icondir/64x64/org.test.Hello.png)
assert_streq $old_icon_hash $new_icon_hash

ok "detached icons"

# Try installing from the remote

${FLATPAK} ${U} install -y oci-registry org.test.Hello >&2

run org.test.Hello &> hello_out
assert_file_has_content hello_out '^Hello world, from a sandbox$'

ok "install"

make_updated_app oci

${FLATPAK} build-bundle --oci $FL_GPGARGS repos/oci oci/app-image org.test.Hello >&2

$client add hello latest $(pwd)/oci/app-image

OLD_COMMIT=`${FLATPAK} ${U} info --show-commit org.test.Hello`

${FLATPAK} ${U} update -y -vv --ostree-verbose org.test.Hello >&2

NEW_COMMIT=`${FLATPAK} ${U} info --show-commit org.test.Hello`

assert_not_streq "$OLD_COMMIT" "$NEW_COMMIT"

run org.test.Hello &> hello_out
assert_file_has_content hello_out '^Hello world, from a sandboxUPDATED$'

ok "update"

# Remove the app from the registry, check that things were removed properly

$client delete hello latest

images=$(${FLATPAK} remote-ls ${U} --columns=app oci-registry | sort | tr '\n' ' ' | sed 's/ $//')
assert_streq "$images" "org.test.Platform"

${FLATPAK} update ${U} --appstream oci-registry >&2

assert_not_file_has_content $appstream '<id>org\.test\.Hello\.desktop</id>'
assert_not_has_file $icondir/64x64/org.test.Hello.png
assert_not_has_file $icondir/64x64

ok "appstream change"

# Build and install an app with zstd-compressed layers

make_updated_app oci "" "" "ZSTD"

${FLATPAK} build-bundle --oci --oci-layer-compress=zstd $FL_GPGARGS repos/oci oci/app-image-zstd org.test.Hello >&2
file "$(pwd)/oci/app-image-zstd/blobs"/**/* | grep -q Zstandard
$client add hello latest "$(pwd)/oci/app-image-zstd"

${FLATPAK} ${U} update -y -vv --ostree-verbose org.test.Hello >&2

run org.test.Hello &> hello_out
assert_file_has_content hello_out '^Hello world, from a sandboxZSTD$'

ok "export and install zstd layers"

# Change the remote to a non-OCI remote, check that we cleaned up

if [ x${USE_SYSTEMDIR-} == xyes ] ; then
    base=$SYSTEMDIR
else
    base=$USERDIR
fi

assert_has_file $base/oci/oci-registry.index.gz
assert_has_file $base/oci/oci-registry.summary
assert_has_dir $base/appstream/oci-registry
${FLATPAK} remote-modify ${U} --url=${scheme}://127.0.0.1:${port} oci-registry >&2
assert_not_has_file $base/oci/oci-registry.index.gz
assert_not_has_file $base/oci/oci-registry.summary
assert_not_has_dir $base/appstream/oci-registry

ok "change remote to non-OCI"

# Change it back and refetch

${FLATPAK} remote-modify ${U} --url=oci+${scheme}://127.0.0.1:${port} oci-registry >&2
${FLATPAK} update ${U} --appstream oci-registry >&2

# Delete the remote, check that everything was removed

assert_has_file $base/oci/oci-registry.index.gz
assert_has_file $base/oci/oci-registry.summary
assert_has_dir $base/appstream/oci-registry
${FLATPAK} ${U} -y uninstall org.test.Hello >&2
${FLATPAK} ${U} -y uninstall org.test.Platform >&2
${FLATPAK} ${U} remote-delete oci-registry >&2
assert_not_has_file $base/oci/oci-registry.index.gz
assert_not_has_file $base/oci/oci-registry.summary
assert_not_has_dir $base/appstream/oci-registry

ok "delete remote"

# Try installing the platform via a flatpakref file. We use a different URL
# for the runtime repo so we can test that the origin remote is pruned on
# uninstall below.

cat << EOF > runtime-repo.flatpakrepo
[Flatpak Repo]
Version=1
Url=oci+${scheme}://localhost:${port}
Title=The OCI Title
EOF

cat << EOF > org.test.Platform.flatpakref
[Flatpak Ref]
Title=Test Platform
Name=org.test.Platform
Branch=master
Url=oci+${scheme}://127.0.0.1:${port}
IsRuntime=true
RuntimeRepo=file://$(pwd)/runtime-repo.flatpakrepo
EOF

${FLATPAK} ${U} install -y --from ./org.test.Platform.flatpakref >&2

${FLATPAK} remotes > remotes-list
assert_file_has_content remotes-list '^platform-origin'

assert_has_file $base/oci/platform-origin.index.gz

ok "install via flatpakref"

# Uninstall, check that the origin remote was pruned, and files were
# cleaned up properly

${FLATPAK} ${U} -y uninstall org.test.Platform >&2

${FLATPAK} remotes > remotes-list
assert_not_file_has_content remotes-list '^platform-origin'

assert_not_has_file $base/oci/platform-origin.index.gz

ok "prune origin remote"

# Install from a (non-OCI) bundle, check that the repo-url is respected

${FLATPAK} build-bundle --runtime --repo-url "oci+${scheme}://127.0.0.1:${port}" $FL_GPGARGS repos/oci org.test.Platform.flatpak org.test.Platform >&2

${FLATPAK} ${U} install -y --bundle org.test.Platform.flatpak >&2

${FLATPAK} remotes -d > remotes-list
assert_file_has_content remotes-list "^platform-origin.*[ 	]oci+${scheme}://127\.0\.0\.1:${port}"

assert_has_file $base/oci/platform-origin.index.gz

ok "install via bundle"

# Install an app from a bundle

${FLATPAK} build-bundle --repo-url "oci+${scheme}://127.0.0.1:${port}" $FL_GPGARGS repos/oci org.test.Hello.flatpak org.test.Hello >&2

${FLATPAK} ${U} install -y --bundle org.test.Hello.flatpak >&2

${FLATPAK} remotes -d > remotes-list
assert_file_has_content remotes-list "^hello-origin.*[ 	]oci+${scheme}://127\.0\.0\.1:${port}"

assert_has_file $base/oci/hello-origin.index.gz

ok "app install via bundle"

# Install an updated app bundle with a different origin

make_updated_app oci
${FLATPAK} build-bundle --repo-url "${scheme}://127.0.0.1:${port}" $FL_GPGARGS repos/oci org.test.Hello.flatpak org.test.Hello >&2

${FLATPAK} ${U} install -y --bundle org.test.Hello.flatpak >&2

${FLATPAK} remotes -d > remotes-list
assert_file_has_content remotes-list "^hello-origin.*[ 	]${scheme}://127\.0\.0\.1:${port}"

assert_not_has_file $base/oci/hello-origin.index.gz

ok "change remote origin via bundle"

${FLATPAK} ${U} -y uninstall org.test.Hello >&2
${FLATPAK} ${U} -y uninstall org.test.Platform >&2

${FLATPAK} ${U} list --columns=application,origin > flatpak-list
assert_not_file_has_content flatpak-list 'org.test.Platform'
assert_not_file_has_content flatpak-list 'org.test.Hello'

${FLATPAK} ${U} remotes --show-disabled > remotes-list
assert_not_file_has_content remotes-list '^platform-origin'
assert_not_file_has_content remotes-list '^hello-origin'

ok "clean up"

# Install from registry via a docker:// location
# TODO: docker:// locations only support HTTPS
# This needs https://github.com/flatpak/flatpak/pull/5916

if false && [ x${USE_SYSTEMDIR-} != xyes ]; then
    $FLATPAK --user -y install docker://127.0.0.1/platform-image:latest >&2

    ${FLATPAK} ${U} list --columns=application,origin > flatpak-list
    assert_file_has_content flatpak-list '^org.test.Platform	*platform-origin$'

    ${FLATPAK} ${U} remotes --show-disabled > remotes-list
    assert_file_has_content remotes-list '^platform-origin'

    ok "install image from registry"
else
    ok "install image from registry # skip  Not supported"
fi

# Test OCI signing

${FLATPAK} build-bundle --runtime --oci "${FL_GPGARGS}" repos/oci oci/platform-image org.test.Platform >&2
digest=$(jq -r '.manifests[0].digest' "$(pwd)/oci/platform-image/index.json")
make_oci_signature "${digest}" "127.0.0.1:${port}/platform:latest" > "$(pwd)/oci/platform-image-signature-1"
make_oci_signature "${digest}" "127.0.0.1:${port}/platform:latest" "${FL_GPGCMDARGS2}"> "$(pwd)/oci/platform-image-signature-2"

$client add platform latest "$(pwd)/oci/platform-image"
$client add-signature platform "${digest}" "$(pwd)/oci/platform-image-signature-1"

${FLATPAK} build-bundle --oci "${FL_GPGARGS}" repos/oci oci/app-image org.test.Hello >&2
digest=$(jq -r '.manifests[0].digest' "$(pwd)/oci/app-image/index.json")
make_oci_signature "${digest}" "127.0.0.1:${port}/hello:latest" > "$(pwd)/oci/app-image-signature-1"
make_oci_signature "${digest}" "127.0.0.1:${port}/hello:latest" "$FL_GPGCMDARGS2" > "$(pwd)/oci/app-image-signature-2"

$client add hello latest "$(pwd)/oci/app-image"

${FLATPAK} ${U} remote-add oci-registry-sig "oci+${scheme}://127.0.0.1:${port}" \
    --signature-lookaside "${scheme}://127.0.0.1:${port}/sig-lookaside" \
    --gpg-import=${FL_GPG_HOMEDIR}/pubring.gpg >&2

if ${FLATPAK} ${U} install -y oci-registry-sig org.test.Hello >&2; then
    assert_not_reached "Should fail install due to missing signature key"
fi

$client add-signature hello "${digest}" "$(pwd)/oci/app-image-signature-2"
if ${FLATPAK} ${U} install -y oci-registry-sig org.test.Hello >&2; then
    assert_not_reached "Should fail install due to wrong signature key"
fi

$client add-signature hello "${digest}" "$(pwd)/oci/app-image-signature-1"
${FLATPAK} ${U} install -y oci-registry-sig org.test.Hello >&2

${FLATPAK} build-bundle --oci "${FL_GPGARGS}" repos/oci oci/app-image org.test.Hello >&2
digest=$(jq -r '.manifests[0].digest' "$(pwd)/oci/app-image/index.json")
make_oci_signature "${digest}" "127.0.0.1:${port}/hello:latest" > "$(pwd)/oci/app-image-signature-1"
make_oci_signature "${digest}" "127.0.0.1:${port}/hello:latest" "$FL_GPGCMDARGS2" > "$(pwd)/oci/app-image-signature-2"

$client add hello latest "$(pwd)/oci/app-image"
if ${FLATPAK} update -y org.test.Hello >&2; then
    assert_not_reached "Should fail install due to outdated signature key"
fi

$client add-signature hello "${digest}" "$(pwd)/oci/app-image-signature-1"
${FLATPAK} update -y org.test.Hello >&2

${FLATPAK} uninstall -y org.test.Hello >&2

${FLATPAK} ${U} remote-delete --force oci-registry-sig >&2
${FLATPAK} ${U} remote-add oci-registry-sig "oci+${scheme}://127.0.0.1:${port}" \
    --signature-lookaside "${scheme}://127.0.0.1:${port}/sig-lookaside" \
    --gpg-import=${FL_GPG_HOMEDIR2}/pubring.gpg >&2

if ${FLATPAK} ${U} install -y oci-registry-sig org.test.Hello >&2; then
    assert_not_reached "Should fail install due to locally changed trusted key"
fi

$client add-signature hello "${digest}" "$(pwd)/oci/app-image-signature-2"

${FLATPAK} ${U} install -y oci-registry-sig org.test.Hello >&2

ok "signed images"

done_testing
