#!/usr/bin/env bash
# 99-package.sh — run on the CONNECTED builder after 00-download.sh.
# Produces a single transferable tarball + SHA256SUMS for the whole bundle.
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
source "$ROOT/config/versions.env"

test -s "$ROOT/images/zaproxy-${ZAP_VERSION}-amd64.tar" \
  || { echo "run scripts/00-download.sh first" >&2; exit 1; }

echo "computing SHA256SUMS over the whole bundle..."
cd "$ROOT"
# Everything except the manifest itself and any previous packaged tarball.
find . -type f \
  ! -name SHA256SUMS \
  ! -name 'devsecops-zap-offline-*.tar.gz' \
  ! -path './.git/*' \
  -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS
echo "$(wc -l < SHA256SUMS) files listed in SHA256SUMS"

out="$ROOT/../devsecops-zap-offline-${ZAP_VERSION}-linux-amd64.tar.gz"
echo "creating $(basename "$out") ..."
tar --create --gzip --file "$out" \
  --exclude='./.git' \
  --directory "$ROOT/.." "$(basename "$ROOT")"
sha256sum "$out" | tee "$out.sha256"
echo "done. Transfer $(basename "$out") and its .sha256 to the air-gapped host."