#!/bin/sh
# Install only the pinned Go toolchain on one worker's durable tools claim.
set -eu

tools=${HERMES_WORKER_TOOLS_DIR:-/worker-data/tools}
bin=${tools}/bin
version=1.26.5

case "$(uname -m)" in
  aarch64)
    dl_arch=arm64
    go_sha=fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49
    ;;
  x86_64)
    dl_arch=amd64
    go_sha=5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053
    ;;
  *)
    echo "unsupported architecture for worker Go toolchain" >&2
    exit 1
    ;;
esac

root=${tools}/go-${version}-${dl_arch}
marker=${tools}/.worker-go-toolchain-${version}-${dl_arch}
expected="go version go${version} linux/${dl_arch}"
mkdir -p "${bin}"

verify() {
  test -x "${root}/bin/go" && test -x "${root}/bin/gofmt" || return 1
  test "$(timeout 15 "${root}/bin/go" version)" = "${expected}" || return 1
  probe=$(mktemp "${tools}/.worker-gofmt.XXXXXX") || return 1
  printf 'package main\nfunc main(){}\n' > "${probe}"
  timeout 15 "${root}/bin/gofmt" -w "${probe}" || { rm -f "${probe}"; return 1; }
  rm -f "${probe}"
}

publish() {
  ln -sfn "../go-${version}-${dl_arch}/bin/go" "${bin}/go"
  ln -sfn "../go-${version}-${dl_arch}/bin/gofmt" "${bin}/gofmt"
  test -x "${bin}/go" && test -x "${bin}/gofmt"
}

if ! verify; then
  rm -f "${marker}"
  rm -rf "${root}"
  work=$(mktemp -d "${tools}/.worker-go.XXXXXX")
  trap 'rm -rf "${work}"' 0 HUP INT TERM
  archive=${work}/go.tar.gz
  curl -fsSL --connect-timeout 15 --max-time 90 --retry 2 --retry-delay 2 \
    -o "${archive}" "https://go.dev/dl/go${version}.linux-${dl_arch}.tar.gz"
  printf '%s  %s\n' "${go_sha}" "${archive}" | sha256sum -c -
  tar -xzf "${archive}" -C "${work}"
  test -d "${work}/go"
  mv "${work}/go" "${root}"
fi

verify
publish
touch "${marker}"