#!/bin/sh
# Invoked only by the administrator-started systemd job with root-owned inputs.
# The job has no network access; all artifacts must exist in its verified cache.
set -eu
if [ "$#" -ne 1 ] || [ "$1" != "$RELEASE_VERSION" ]; then
    echo 'Release instance must match the approved job configuration' >&2
    exit 1
fi
case "$RELEASE_VERSION" in
    *[!0-9A-Za-z.+-]*|'') exit 1 ;;
esac
RELEASE_CHANNEL=${RELEASE_CHANNEL:-rc}
case "$RELEASE_CHANNEL" in
    rc) ;;
    stable)
        case "${RELEASE_VERSION%%+*}" in *-*) echo 'Stable signing refuses prerelease versions' >&2; exit 1 ;; esac
        ;;
    *) echo 'Unknown release channel' >&2; exit 1 ;;
esac
cd "/var/lib/mpv-release-signer/v$RELEASE_VERSION"
MANIFEST_SIGNING_KEY=$(cat "$CREDENTIALS_DIRECTORY/manifest-key")
export MANIFEST_SIGNING_KEY
exec "$RELEASE_TOOLS/generate-info" \
    -auto -quiet -sign \
    -manager-version "$RELEASE_VERSION" -channel "$RELEASE_CHANNEL" \
    -manager-download-base "$MANAGER_DOWNLOAD_BASE" \
    -manager-artifacts-dir manager-artifacts \
    -provenance-lock provenance.json \
    -output output/releases.json