#!/bin/bash
## kola:
##   exclusive: false
##   distros: fcos
##   description: |
##      Verify that the deployed container image on the disk image has
##      a correct ostree sigverify prefix.

set -euo pipefail

# shellcheck disable=SC1091
. "$KOLA_EXT_DATA/commonlib.sh"

EXPECTED_IMGREF_PREFIX="ostree-image-signed:docker://"

# get the running container imgref
booted_imgref=$(rpm-ostree status --booted --json | jq -r '.deployments[0]."container-image-reference"')

# Verify the booted imgref starts with the expected prefix
if [[ ! $booted_imgref =~ ^$EXPECTED_IMGREF_PREFIX ]]; then
  echo "booted deployment imgref:" "$booted_imgref"
  echo "Expected prefix:" "$EXPECTED_IMGREF_PREFIX"
  fatal "The booted deployment imgref does not start with the expected prefix"
fi

# Verify ostree does accept the imgref as valid. Using --help
# avoids reaching out to the remote registry while still
# validating the imgref format locally.

# First, verify the --help trick rejects an invalid imgref so we
# know it is actually validating.
if ostree container info "invalid-imgref:docker://example.com/repo:tag" --help 2>/dev/null; then
  fatal "ostree container info did not reject an invalid imgref"
fi

# Now validate the real booted imgref
ostree container info "$booted_imgref" --help
ok
