#!/bin/sh
set -eu

fail=0
for name in .DS_Store __MACOSX .git; do
  if find . -name "$name" -print | grep -q .; then
    echo "[fail] found forbidden metadata: $name"
    fail=1
  fi
done

if find . -type f \( -name '*.key' -o -name '*.pem' -o -name '*.p12' -o -name '*.pfx' -o -name '*.dylib' -o -name '*.exe' \) -print | grep -q .; then
  echo '[fail] found a forbidden secret or binary file type'
  fail=1
fi

if find . -path './tools/v' -prune -o -path './verify.sh' -prune -o -type f -print0 | xargs -0 grep -IlE 'BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY|api[_-]?key[[:space:]]*=|secret[[:space:]]*=' 2>/dev/null | grep -q .; then
  echo '[fail] possible credential material detected outside third-party source'
  fail=1
fi

if find . -path './verify.sh' -prune -o -type f -print0 | xargs -0 grep -IlE 'agila_arch_idt|idt_common_handler|idt_dispatch' 2>/dev/null | grep -q .; then
  echo '[fail] proprietary kernel-IDT material detected'
  fail=1
fi

if [ "$fail" -ne 0 ]; then
  exit 1
fi

echo '[ok] public-release checks passed'