#!/usr/bin/env bash
# Download real jars from Maven Central (sha1-checked) into a throw-away dir and scan them with tools/ScanJar.java.
#   JDK25=/path/to/jdk-25 ./scripts/scan-libs.sh [--classes]   needs network; ONLY='regex' limits the coordinate list
set -uo pipefail
unset JAVA_TOOL_OPTIONS
HERE="$(cd "$(dirname "$0")/.." && pwd)"
JDK25="${JDK25:-/tmp/tools/jdk-25.0.5+8}"
D="$(mktemp -d)"; trap 'rm -rf "$D"' EXIT
COORDS="
io.netty:netty-common:4.2.20.Final
io.netty:netty-common:4.1.140.Final
io.netty:netty-common:4.1.100.Final
com.google.guava:guava:33.8.0-jre
com.google.guava:guava:32.1.3-jre
org.apache.lucene:lucene-core:10.6.0
org.apache.lucene:lucene-core:9.12.3
com.esotericsoftware:kryo:5.7.1
org.apache.hadoop:hadoop-common:3.5.0
org.apache.hadoop:hadoop-common:3.3.6
org.apache.cassandra:cassandra-all:5.0.9
org.agrona:agrona:2.7.1
org.jctools:jctools-core:4.0.7
com.github.ben-manes.caffeine:caffeine:3.3.1
com.google.protobuf:protobuf-java:4.36.2
org.xerial.snappy:snappy-java:1.1.10.12
org.apache.spark:spark-unsafe_2.13:4.3.0
"
JARS=()
for c in $(echo "$COORDS" | grep -E "${ONLY:-.}"); do
  IFS=: read -r g a v <<<"$c"
  url="https://repo1.maven.org/maven2/${g//.//}/$a/$v/$a-$v.jar"
  ok=no
  for try in 1 2 3 4 5 6 7 8; do sleep 1;   # the sandbox proxy occasionally truncates a transfer; the sha1 check catches it
    curl -sfL -o "$D/$a-$v.jar" "$url" || continue
    want="$(curl -sfL "$url.sha1" | cut -c1-40)"; got="$(sha1sum "$D/$a-$v.jar" | cut -c1-40)"
    [ -n "$want" ] && [ "$want" = "$got" ] && { ok=yes; break; }
  done
  [ $ok = yes ] && echo "sha1 ok  $c" || { echo "FAILED (download or sha1) $c"; continue; }
  JARS+=("$D/$a-$v.jar")
done
echo
"$JDK25/bin/java" "$HERE/tools/ScanJar.java" "$@" "${JARS[@]}" 2>&1 | sed "s#$D/##g"