#!/usr/bin/env bash
# Upload a release's artifacts with SHA256SUMS to
# https://albedo-artifacts.fsn1.your-objectstorage.com/releases/<name>/.
# Needs S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY: a key the bucket policy lets
# write under releases/ only (see robot-docs/release.md).
# Usage: release/upload.sh <name> <file>...
set -euo pipefail
name="$1"
shift
: "${S3_ACCESS_KEY_ID:?}" "${S3_SECRET_ACCESS_KEY:?}"
endpoint="${S3_ENDPOINT:-https://albedo-artifacts.fsn1.your-objectstorage.com}"
region="${S3_REGION:-fsn1}"
sums="$(mktemp -d)/SHA256SUMS"
(cd "$(dirname "$1")" && sha256sum "${@##*/}") >"$sums"
for file in "$@" "$sums"; do
  key="releases/$name/$(basename "$file")"
  # The key goes to curl on stdin, never on its command line.
  printf 'user = "%s:%s"\n' "$S3_ACCESS_KEY_ID" "$S3_SECRET_ACCESS_KEY" |
    curl -K - --fail-with-body -sS --aws-sigv4 "aws:amz:$region:s3" \
      -H "content-type: application/octet-stream" -T "$file" "$endpoint/$key" >/dev/null
  echo "$endpoint/$key"
done
cat "$sums"