#!/usr/bin/env bash
set -euo pipefail
if [ "$#" -ne 4 ]; then echo "Usage: $0 BASE_ISO OFFLINE_PAYLOAD RELEASE_PRIVATE_KEY OUTPUT_ISO" >&2; exit 2; fi
base=$(cd "$(dirname "$1")" && pwd)/$(basename "$1")
payload=$(cd "$(dirname "$2")" && pwd)/$(basename "$2")
key=$(cd "$(dirname "$3")" && pwd)/$(basename "$3")
out=$4
for f in "$base" "$payload" "$key"; do test -s "$f" || { echo "Missing/empty required input: $f" >&2; exit 1; }; done
case "$(basename "$payload")" in *model*|*gguf*|*safetensors*) echo "Model payloads are forbidden in RC1" >&2; exit 1;; esac
command -v xorriso >/dev/null; command -v openssl >/dev/null
work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
xorriso -osirrox on -indev "$base" -extract / "$work/iso" >/dev/null 2>&1
mkdir -p "$work/iso/nexus/rc1"
cp "$payload" "$work/iso/nexus/rc1/offline-payload.tar.zst"
cp "$(dirname "$0")/release.json" "$(dirname "$0")/feature-profiles.json" "$(dirname "$0")/agent-registry.schema.json" "$work/iso/nexus/rc1/"
(cd "$work/iso/nexus/rc1" && find . -type f -print0 | sort -z | xargs -0 shasum -a 256 > SHA256SUMS)
openssl dgst -sha256 -sign "$key" -out "$work/iso/nexus/rc1/SHA256SUMS.sig" "$work/iso/nexus/rc1/SHA256SUMS"
echo "RC1 content staged and signed. Use the Ubuntu-preserving hybrid repack in phase2/appliance-iso/build-iso.sh on the approved amd64 build host." >&2
echo "$work/iso"
test "${NEXUS_ALLOW_UNQUALIFIED_REPACK:-0}" = 1 || { echo "Refusing unqualified local repack; stage path retained only during this process." >&2; exit 1; }