#!/usr/bin/env bash
# Download a port's release tarball into the download cache (default cache/)
# and check it against the SHA256 pinned in ports/NAME/NAME.sha256. Nothing
# downloaded is ever committed: cache/ is git-ignored.
#
# NAME.url lists one or more download URLs, one per line, tried in order
# (upstream first, then mirrors). The SHA256 decides, not the URL: a mirror
# copy is only kept if it is byte-for-byte the pinned release.
#
# Offline? Put the tarball in cache/ yourself (any copy with the right
# SHA256 is fine).
#
# Usage: ports/fetch.sh NAME [CACHE_DIR]
set -euo pipefail
HERE=$(cd "$(dirname "$0")" && pwd)
NAME=$1 CACHE=${2:-cache}
mkdir -p "$CACHE"
read -r sum file < "$HERE/$NAME/$NAME.sha256"
dest=$CACHE/$file
if [ ! -f "$dest" ]; then
    while read -r url; do
        [ -n "$url" ] || continue
        echo "[$NAME] downloading $url"
        if curl -fsSL --retry 2 -m 120 -o "$dest.part" "$url" &&
           echo "$sum  $dest.part" | sha256sum -c --quiet - 2>/dev/null; then
            mv "$dest.part" "$dest"; break
        fi
        echo "[$NAME] failed or wrong SHA256, trying the next URL"; rm -f "$dest.part"
    done < "$HERE/$NAME/$NAME.url"
fi
if echo "$sum  $dest" | sha256sum -c --quiet -; then
    echo "[$NAME] $dest: SHA256 OK"
else
    echo "[$NAME] $dest: SHA256 MISMATCH -- delete it and try again"; exit 1
fi