#!/bin/sh

MANIFEST_URL="https://getalby.com/install/hub/manifest.txt"
SIGNATURE_URL="https://getalby.com/install/hub/manifest.txt.asc"

verify_package() {
  archive_file="${1}"
  filename_in_manifest="${2}"
  response=""

  while true; do
    printf "Verify package signature and integrity? (Y/N): "
    read response
    case "$response" in
      [Yy]*) break ;;
      [Nn]*)
        echo "Verification skipped."
        return 0
        ;;
      *) echo "Invalid input. Please enter Y or N." ;;
    esac
  done

  for cmd in gpg sha256sum; do
    if ! command -v "$cmd" > /dev/null 2>&1; then
      echo "❌ Required command '$cmd' is not available." >&2
      return 1
    fi
  done

  echo "Downloading manifest file..."
  if ! wget -q -O manifest.txt "$MANIFEST_URL"; then
    echo "❌ Failed to download manifest file." >&2
    return 1
  fi

  echo "Downloading manifest signature file..."
  if ! wget -q -O manifest.txt.asc "$SIGNATURE_URL"; then
    echo "❌ Failed to download manifest signature file." >&2
    return 1
  fi

  if ! gpg --batch --verify "manifest.txt.asc" "manifest.txt"; then
    echo "❌ GPG signature verification failed!" >&2
    echo "Visit https://github.com/getAlby/hub/releases for more information on how to verify the release" >&2
    return 1
  fi

  expected_hash=$(grep "${filename_in_manifest}" "manifest.txt" | awk '{print $1}') || true
  if [ -z "$expected_hash" ]; then
    echo "❌ No hash entry found for ${filename_in_manifest} in the manifest." >&2
    return 1
  fi

  actual_hash=$(sha256sum "$archive_file" | awk '{print $1}')

  if [ "$expected_hash" != "$actual_hash" ]; then
    echo "❌ SHA256 hash mismatch! The file may be corrupted or tampered with." >&2
    return 1
  fi

  echo "✅ Verification successful. The package is authentic and intact."
  return 0
}

if [ $# -ne 2 ]; then
  echo "Usage: $0 <archive_file> <filename_in_manifest>"
  exit 1
fi

if ! verify_package "$1" "$2"; then
  exit 1
fi