#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
: "${CACHE_ROOT:=/vuln-cache/vuln-builder}"
: "${GITEA_BASE_URL:=https://git.apex-project.de}"
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN missing}"
mkdir -p "$CACHE_ROOT" "$CACHE_ROOT/sources" "$CACHE_ROOT/releases"
exec 9>"$CACHE_ROOT/.build.lock"
/usr/bin/flock -w 1800 9 || { echo 'Another builder run in progress' >&2; exit 1; }
export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader
GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
export GIT_CONFIG_VALUE_0
# Configurable list; extra feeds tracked in manifest but not yet indexed.
SOURCES="${VULN_SOURCES:-vuln-cve vuln-nvd vuln-osv vuln-cpe vuln-exploits vuln-microsoft vuln-redhat vuln-oracle vuln-bsi vuln-debian vuln-ubuntu vuln-alpine vuln-suse vuln-suse-vex vuln-almalinux vuln-rocky}"
for name in $SOURCES; do
  [[ "$name" =~ ^vuln-[a-z0-9-]+$ ]] || { echo "Invalid source name: $name" >&2; exit 1; }
  repo="$CACHE_ROOT/sources/$name"
  url="${GITEA_BASE_URL%/}/VULN/$name.git"
  if [ ! -d "$repo/.git" ]; then
    echo "Cloning $name"
    git clone --quiet --depth 1 --single-branch --branch main "$url" "$repo"
  else
    echo "Updating $name"
    git -C "$repo" fetch --quiet --depth 1 origin main
    git -C "$repo" reset --hard -q FETCH_HEAD
    git -C "$repo" clean -fdq
  fi
done
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
cd "$(dirname "$0")/.."
python3 scripts/build.py --sources "$CACHE_ROOT/sources" --output "$CACHE_ROOT/releases"
echo 'Release files:'
ls -lh "$CACHE_ROOT/releases"/*.zst "$CACHE_ROOT/releases"/manifest.json