#!/usr/bin/env sh
# Build tooling only. All downloaded executable bytes must match official release hashes.
set -eu
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
JAR="$ROOT/gradle/wrapper/gradle-wrapper.jar"
EXPECTED=7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172
DIST_EXPECTED=6f74b601422d6d6fc4e1f9a1ab6522f642c2fdcbc15ae33ebd30ba3d7198e854
mkdir -p "$(dirname "$JAR")"
WORK=$(mktemp -d "$ROOT/gradle/wrapper/bootstrap.XXXXXX")
trap 'rm -rf "$WORK"' EXIT HUP INT TERM
fetch() {
    if command -v curl >/dev/null 2>&1; then
        curl --fail --location --proto '=https' --tlsv1.2 --connect-timeout 15 --max-time 300 "$1" -o "$2"
    elif command -v wget >/dev/null 2>&1; then
        wget --https-only --timeout=30 "$1" -O "$2"
    else
        echo 'Install curl/wget, or generate the wrapper with an installed Gradle 8.14.5.' >&2
        return 1
    fi
}
checksum() {
    if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d ' ' -f 1
    elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d ' ' -f 1
    else echo 'No SHA-256 utility found; refusing unverified tooling.' >&2; return 1; fi
}
printf '%s\n' 'Fetching the official Gradle 8.14.5 wrapper; a pinned SHA-256 is required.'
fetch https://raw.githubusercontent.com/gradle/gradle/v8.14.5/gradle/wrapper/gradle-wrapper.jar "$WORK/wrapper.jar"
ACTUAL=$(checksum "$WORK/wrapper.jar")
if [ "$ACTUAL" != "$EXPECTED" ]; then
    # A source tag can contain an older build's wrapper. Never execute that mismatch.
    # The released distribution contains the exact wrapper as an embedded resource.
    printf '%s\n' 'Tag wrapper does not match the release checksum; retrieving the verified release distribution.'
    command -v unzip >/dev/null 2>&1 || {
        echo 'Install unzip for this fallback, or generate the wrapper with installed Gradle 8.14.5.' >&2
        exit 1
    }
    fetch https://services.gradle.org/distributions/gradle-8.14.5-bin.zip "$WORK/gradle.zip"
    [ "$(checksum "$WORK/gradle.zip")" = "$DIST_EXPECTED" ] || {
        echo 'Gradle distribution checksum mismatch; refusing to execute.' >&2; exit 1
    }
    ENTRY=$(unzip -Z1 "$WORK/gradle.zip" | grep '/gradle-wrapper-main-8\.14\.5\.jar$')
    [ "$(printf '%s\n' "$ENTRY" | wc -l | tr -d ' ')" = 1 ] || {
        echo 'Expected exactly one wrapper-main JAR in the verified release.' >&2; exit 1
    }
    unzip -p "$WORK/gradle.zip" "$ENTRY" > "$WORK/wrapper-main.jar"
    unzip -p "$WORK/wrapper-main.jar" gradle-wrapper.jar > "$WORK/wrapper.jar"
    [ "$(checksum "$WORK/wrapper.jar")" = "$EXPECTED" ] || {
        echo 'Embedded wrapper checksum mismatch; refusing to execute.' >&2; exit 1
    }
fi
mv "$WORK/wrapper.jar" "$JAR"
printf '%s\n' 'Official wrapper verified. The Gradle distribution is separately checksum-pinned.'