#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
P="$CASAN_HARNESS_ROOT/scripts/bash/release-provenance.sh"
W="$(mktemp -d)"; trap 'rm -rf "$W"' EXIT
PASS=0; FAIL=0
pass() { echo "PASS: $1"; PASS=$((PASS+1)); }
fail() { echo "FAIL: $1"; FAIL=$((FAIL+1)); }
rc() { set +e; "$@" >/dev/null 2>&1; local c=$?; set -e; echo "$c"; }
openssl genrsa -out "$W/key.pem" 2048 2>/dev/null
openssl rsa -in "$W/key.pem" -pubout -out "$W/pub.pem" 2>/dev/null
openssl genrsa -out "$W/other.pem" 2048 2>/dev/null
printf '{"bomFormat":"CycloneDX"}\n' > "$W/sbom.json"; printf 'tests passed\n' > "$W/evidence.txt"
DIGEST="sha256:$(printf 'a%.0s' {1..64})"
bash "$P" create "$W/provenance.json" "$W/key.pem" "$W/sbom.json" "$W/evidence.txt" "registry.local/casan/api@$DIGEST" >/dev/null \
  && bash "$P" verify "$W/provenance.json" "$W/pub.pem" >/dev/null && pass "signed provenance binds commit and image digest" || fail "valid provenance rejected"
printf 'tamper' >> "$W/provenance.json"
[[ "$(rc bash "$P" verify "$W/provenance.json" "$W/pub.pem")" -ne 0 ]] && pass "tampered provenance is refused" || fail "tampered provenance accepted"
[[ "$(rc bash "$P" create "$W/bad.json" "$W/key.pem" "$W/sbom.json" "$W/evidence.txt" 'registry.local/casan/api:latest')" -ne 0 ]] && pass "floating image tag is refused" || fail "floating image accepted"
bash "$P" create "$W/other.json" "$W/other.pem" "$W/sbom.json" "$W/evidence.txt" "registry.local/casan/api@$DIGEST" >/dev/null
[[ "$(rc bash "$P" verify "$W/other.json" "$W/pub.pem")" -ne 0 ]] && pass "provenance signed by another key is refused" || fail "wrong signing key accepted"
echo "===== RELEASE PROVENANCE SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]]