#!/usr/bin/env bash
# Registry distribution stays content-addressed: a tag is only a discovery aid.
set -euo pipefail

ROOT="$(mktemp -d)"
trap 'rm -rf "$ROOT"' EXIT
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUILD="$SCRIPT_DIR/../bin/sandbox-image-build"

mkdir -p "$ROOT/root/image-context" "$ROOT/root/lib" "$ROOT/bin"
cp "$SCRIPT_DIR/../lib/image-context.sh" "$ROOT/root/lib/"
printf 'FROM scratch\n' >"$ROOT/root/image-context/Containerfile"
printf 'FROM scratch\n' >"$ROOT/root/image-context/Containerfile.e2e"

cat >"$ROOT/bin/podman" <<'SH'
#!/usr/bin/env bash
set -euo pipefail
case "$1" in
  manifest)
    # The registry's content for the content-addressed tag is wrong.
    printf 'sha256:%064d\n' 7
    ;;
  pull)
    printf '%s\n' "$2" >>"$PODMAN_LOG"
    ;;
  image)
    case "$2" in
      inspect) printf 'sha256:%064d wrong\n' 7 ;;
      exists) exit 0 ;;
    esac
    ;;
  *) exit 0 ;;
esac
SH
chmod +x "$ROOT/bin/podman"

set +e
output="$(HOME="$ROOT/home" PATH="$ROOT/bin:$PATH" PODMAN_LOG="$ROOT/podman.log" \
  SANDBOX_HOST_ROOT="$ROOT/root" SANDBOX_CLUSTER_REGISTRY='registry.test:5000' \
  bash "$BUILD" --pull 2>&1)"
rc=$?
set -e

if [ "$rc" -ne 0 ] && grep -qF 'registry advertised a digest with context=wrong' <<<"$output"; then
  printf 'PASS wrong registry digest is refused\n'
  exit 0
fi

printf 'FAIL wrong digest refusal (rc=%s)\n%s\n' "$rc" "$output" >&2
exit 1