#!/usr/bin/env bash
# Regenerates every file in output/. Needs JDK 25, Maven 3.9, python3 and network access to api.osv.dev.
# Spring Boot 4.2.0-RC1 is a release candidate, so the first run downloads it from Maven Central.
set -uo pipefail
cd "$(dirname "$0")/.."
rm -rf output && mkdir output
JAR=target/sbom-1.0.0.jar
TOOLS="java -Djarmode=tools -jar $JAR"

# Tests write 05 and 06 (and need the SBOM the build puts into target/classes).
mvn -B -q clean test >/dev/null 2>&1 || { echo "tests failed"; exit 1; }

# A jar built with SBOM generation switched off.
mvn -B -q clean package -DskipTests -Dcyclonedx.skip=true >/dev/null 2>&1
cp $JAR /tmp/sbom-without.jar
{
  echo '$ unzip -p sbom-without.jar META-INF/MANIFEST.MF | grep -i sbom'
  unzip -p /tmp/sbom-without.jar META-INF/MANIFEST.MF | grep -i sbom || echo '(no matching line)'
  echo '$ java -Djarmode=tools -jar sbom-without.jar sbom'
  java -Djarmode=tools -jar /tmp/sbom-without.jar sbom 2>&1
  echo "exit code: $?"
} > output/02-no-sbom.txt

# The normal build.
mvn -B -q clean package -DskipTests >/dev/null 2>&1
{
  echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar help'
  $TOOLS help 2>&1
  echo
  echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar help sbom'
  $TOOLS help sbom 2>&1
} > output/01-jarmode-help.txt

{
  echo '$ unzip -p sbom-1.0.0.jar META-INF/MANIFEST.MF | grep -i sbom'
  unzip -p $JAR META-INF/MANIFEST.MF | grep -i sbom
  $TOOLS sbom > /tmp/from-command.json; echo "exit code of 'sbom': $?"
  echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar sbom   (first 120 characters)'
  head -c 120 /tmp/from-command.json; echo
  $TOOLS sbom --destination /tmp/from-destination.json >/dev/null 2>&1; echo "--destination exit code: $?"
  unzip -p $JAR META-INF/sbom/application.cdx.json > /tmp/from-zip.json
  echo "bytes: command $(wc -c < /tmp/from-command.json), --destination $(wc -c < /tmp/from-destination.json), unzip $(wc -c < /tmp/from-zip.json)"
  echo "SHA-256 of the three files: $(sha256sum /tmp/from-command.json /tmp/from-destination.json /tmp/from-zip.json | cut -d' ' -f1 | sort -u | wc -l) distinct value(s)"
} > output/03-sbom-command.txt

bash scripts/commands-by-version.sh > output/11-jarmode-commands-by-version.txt
python3 scripts/analyse.py inspect /tmp/from-command.json > output/04-inspect.txt
python3 scripts/analyse.py compare /tmp/from-command.json $JAR > output/07-sbom-against-jar.txt
python3 scripts/analyse.py licences /tmp/from-command.json > output/08-licences.txt
{ echo "scanned: $(date -u +%Y-%m-%d)"; python3 scripts/analyse.py scan /tmp/from-command.json; } > output/09-osv-scan-clean.txt

# The same build with one old library added.
mvn -B -q clean package -DskipTests -Pvulnerable >/dev/null 2>&1
java -Djarmode=tools -jar $JAR sbom > /tmp/vulnerable.json
{ echo "scanned: $(date -u +%Y-%m-%d)"; python3 scripts/analyse.py scan /tmp/vulnerable.json; } > output/10-osv-scan-vulnerable.txt

mvn -B -q clean package -DskipTests >/dev/null 2>&1
echo "done: $(ls output | wc -l) files in output/"