#!/bin/bash

## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Install diffoscope and the format-descent helpers the reproducibility lane
## (.github/workflows/local-reproducible-build-test.yml) needs to compare two build images.
## Kept as a ci/ script (github-actions-security.md rule 7) so this post-checkout
## shell is shellcheck / 'bash -n' covered and runnable locally, rather than an
## inline workflow 'run:' block.
##
## diffoscope comes from trixie-backports, not trixie: trixie ships 297, which
## OOMs when diffing a large DIFFERING member of two multi-GB images, whereas
## backports (>= 302, currently 306) has the streaming fix. Identical images
## short-circuit either way, but a real difference must produce a report, not an
## OOM. trixie-backports is enabled below and diffoscope pulled from it with
## '-t'; the descenders resolve from trixie as normal (they have no backports
## candidate, so '-t' does not disturb them).
##
## --no-install-recommends keeps diffoscope's large optional recommends (LaTeX
## and friends) out; the descenders the lane's images actually need are named
## explicitly: ISO 9660 (genisoimage), squashfs (squashfs-tools), tar/OVA
## (built-in), qcow2 / vmdk / vdi (qemu-utils' qemu-img), 7z containers
## (7zip), raw hexdump (xxd), and fakeroot so squashfs/device nodes and
## ownership compare fully. reproducible-compare only WARNs on a missing
## descender, so an unlisted format degrades gracefully.

set -o errexit
set -o nounset
set -o pipefail
set -o errtrace
shopt -s inherit_errexit
shopt -s shift_verbose
export LC_ALL=C

true "INFO: Currently running script: ${BASH_SOURCE[0]} $*"

MYDIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" && pwd )"

## Enable trixie-backports so diffoscope can be pulled from it: copy the static
## ci/trixie-backports.sources drop-in (a single suite; the build's own sources
## are untouched) rather than generating it inline.
## 'has' rather than 'command -v' (R-090): it verifies the hit is executable and
## is not an alias or shell function.
# shellcheck source=../packages/kicksecure/helper-scripts/usr/libexec/helper-scripts/has.bsh
source "${MYDIR}/../packages/kicksecure/helper-scripts/usr/libexec/helper-scripts/has.bsh"

sudo cp -- "${MYDIR}/trixie-backports.sources" /etc/apt/sources.list.d/trixie-backports.sources

sudo apt-get update
## 7zip, not p7zip-full; p7zip-full is a transitional package pointing at
## 7zip.
sudo apt-get install --yes --no-install-recommends -t trixie-backports \
   diffoscope \
   genisoimage \
   squashfs-tools \
   fakeroot \
   xxd \
   7zip \
   qemu-utils \
   kmod

## Assert, do not assume. This is the compare job's ONLY preflight: it runs
## 'docker-run -- ci/reproducible-compare' and no build step, so
## build-steps.d/1100_sanity-tests -- where the build checks its own tools --
## never executes here. A tool missing at this point does not fail loudly; it
## makes dm-reproducible-compare-artifacts fall back from the mounted route to
## comparing packed artifacts directly, which OOMs on a multi-gigabyte image and
## reports "diffoscope could not explain the diff", naming nothing. 'kmod' was
## exactly that gap.
missing_tools=""
for required_tool in modprobe qemu-nbd qemu-img diffoscope mountpoint ; do
   if has "${required_tool}" ; then
      continue
   fi
   missing_tools="${missing_tools} ${required_tool}"
done

if [ -n "${missing_tools}" ]; then
   printf '%s\n' "${0##*/}: ERROR: still missing after install:${missing_tools}" >&2
   printf '%s\n' "${0##*/}: the reproducibility comparison needs these; without them it degrades to an unattributable 'could not explain the diff'." >&2
   exit 1
fi
printf '%s\n' "${0##*/}: comparison tooling present." >&2
