#!/usr/bin/env bash
# Fetch (with retries) and sha256-verify the pristine Buildroot tarball into $1.
#
# WHY THIS EXISTS. The firmware builds against
# sysdrv/source/buildroot/buildroot-2025.02.8 inside the vendor SDK. That tree
# is NOT in the vendor checkout -- the SDK ships 2023.02.6 -- and nothing
# recorded where it came from, so the build was reproducible only on the one
# machine that happened to have the directory (flare-edge#135). Buildroot signs
# its releases with GPG rather than publishing a .sha256, so the pin here was
# computed from the downloaded tarball and is what this script verifies against.
#
# Same shape as fetch-kernel-tarball.sh, deliberately: a version bump edits this
# file and the pin beside it, nothing else. FAILS CLOSED on a missing pin.
#
# Not wired into build-firmware.sh or CI yet -- tools/build-firmware.sh stages
# sdk-patches/buildroot/ onto whatever buildroot tree the vendor SDK already
# has, it does not yet extract this pinned tarball over it. Exercised today by
# tests/fetch-buildroot-tarball/run-fetch-buildroot-tarball-tests.sh and by
# running the script by hand; wiring it into the real build path is a separate
# change (it has to reconcile the pristine tree with the existing SDK buildroot
# checkout first).
#
# Usage: fetch-buildroot-tarball.sh <destination-path>
set -euo pipefail

BRVER=2025.02.8
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"     # build/
SHA_FILE="$HERE/buildroot-$BRVER.tar.xz.sha256"
URL="https://buildroot.org/downloads/buildroot-$BRVER.tar.xz"

TB="${1:?usage: fetch-buildroot-tarball.sh <destination-path>}"

[ -f "$SHA_FILE" ] || {
  echo "FATAL: no pinned sha256 for buildroot-$BRVER (expected $SHA_FILE):" >&2
  echo "       refusing an unverified tarball" >&2
  exit 1
}
WANT="$(awk '{print $1; exit}' "$SHA_FILE")"

verify() {
  [ -f "$TB" ] || return 1
  local got
  got="$(sha256sum "$TB" | awk '{print $1}')"
  [ "$got" = "$WANT" ]
}

if verify; then
  echo "buildroot-$BRVER: already present and verified"
  exit 0
fi

for attempt in 1 2 3; do
  echo "== fetching buildroot-$BRVER (attempt $attempt)"
  # --retry only re-fires once curl decides a transfer has failed; a connection
  # that opens and then stalls (blackholed route, hung proxy) never reaches
  # that decision and would otherwise block forever. --connect-timeout bounds
  # the handshake, --max-time bounds the whole request.
  if curl -fsSL --retry 2 --connect-timeout 20 --max-time 120 -o "$TB" "$URL" && verify; then
    echo "buildroot-$BRVER: sha256 verified"
    exit 0
  fi
  rm -f "$TB"
done

echo "FATAL: could not fetch a buildroot-$BRVER tarball matching $WANT" >&2
exit 1