#!/usr/bin/env bash
# Vérifie SHA256SUMS.txt du kit (wrapper).
# Préfère python3 verify_kit_integrity.py ; sinon sha256sum -c.
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SUMS="${1:-$ROOT/SHA256SUMS.txt}"
DIR="$(cd "$(dirname "$SUMS")" && pwd)"
SUMS="$DIR/$(basename "$SUMS")"

if [[ ! -f "$SUMS" ]]; then
  printf 'FAIL  SHA256SUMS introuvable: %s\n' "$SUMS" >&2
  exit 1
fi

if [[ -f "$ROOT/verify_kit_integrity.py" ]]; then
  exec python3 "$ROOT/verify_kit_integrity.py" --dir "$DIR" --sums "$SUMS"
fi
if [[ -f "$DIR/verify_kit_integrity.py" ]]; then
  exec python3 "$DIR/verify_kit_integrity.py" --dir "$DIR" --sums "$SUMS"
fi

if command -v sha256sum >/dev/null 2>&1; then
  # GNU coreutils : -c vérifie ; --ignore-missing non portable → on reste strict
  (cd "$DIR" && sha256sum -c "$(basename "$SUMS")")
  printf 'INTÉGRITÉ VERT (sha256sum -c)\n'
  exit 0
fi

printf 'FAIL  ni python3 script ni sha256sum disponibles\n' >&2
exit 1
