#!/bin/bash -x
set -euo pipefail

ARCHIVE=$1
WORK_DIR=$2

ARCHIVE="${ARCHIVE#"${ARCHIVE%%[![:space:]]*}"}"
ARCHIVE="${ARCHIVE%"${ARCHIVE##*[![:space:]]}"}"
WORK_DIR="${WORK_DIR#"${WORK_DIR%%[![:space:]]*}"}"
WORK_DIR="${WORK_DIR%"${WORK_DIR##*[![:space:]]}"}"

if [[ -z "$ARCHIVE" || -z "$WORK_DIR" ]]; then
    echo "Usage: prepare-build-fs <archive> <work-dir>"
    exit 1
fi

if [[ "$WORK_DIR" == "/" || "$WORK_DIR" == "/home" || "$WORK_DIR" == "/usr" || "$WORK_DIR" == "/etc" || "$WORK_DIR" == "/var" || "$WORK_DIR" == "/tmp" || "$WORK_DIR" == "/boot" || "$WORK_DIR" == "/dev" || "$WORK_DIR" == "/proc" || "$WORK_DIR" == "/sys" || "$WORK_DIR" == "/run" ]]; then
    echo "Error: refusing to operate on dangerous path: $WORK_DIR"
    exit 1
fi

rm -rf "$WORK_DIR"/*
tar -xf "$ARCHIVE" -C "$WORK_DIR"

# TXPK_FORCE_NETWORK_FIX
# Force DNS and CA certs into the build chroot after extraction.
if [[ -n "${WORK_DIR:-}" && -d "$WORK_DIR" ]]; then
  mkdir -p "$WORK_DIR/etc"
  mkdir -p "$WORK_DIR/etc/ssl/certs"
  mkdir -p "$WORK_DIR/etc/pki/tls/certs"
  mkdir -p "$WORK_DIR/usr/lib/ssl"

  cat > "$WORK_DIR/etc/resolv.conf" <<'RESOLV'
nameserver 1.1.1.1
nameserver 8.8.8.8
RESOLV

  if [[ -f /etc/ssl/certs/ca-certificates.crt ]]; then
    cp -L /etc/ssl/certs/ca-certificates.crt "$WORK_DIR/etc/ssl/certs/ca-certificates.crt"
    cp -L /etc/ssl/certs/ca-certificates.crt "$WORK_DIR/etc/pki/tls/certs/ca-bundle.crt"
    chmod 644 "$WORK_DIR/etc/ssl/certs/ca-certificates.crt"
    chmod 644 "$WORK_DIR/etc/pki/tls/certs/ca-bundle.crt"
  fi

  ln -sf /etc/ssl/certs/ca-certificates.crt "$WORK_DIR/etc/ssl/cert.pem"
  ln -sf /etc/pki/tls/certs/ca-bundle.crt "$WORK_DIR/usr/lib/ssl/cert.pem"
fi
