#!groovy

LABEL=params.LABEL ? params.LABEL : 'ci.role.test&&hw.arch.x86&&sw.os.linux'

TEMURIN_BUILD_REPO="https://github.com/adoptium/temurin-build"
TEMURIN_BUILD_BRANCH="master"

stage('Queue') {
    node("$LABEL") {
       cleanWs()
       fetchDeps()
    }
}

// Fetch a single file from a location under Maven.
// Args:
//   - jarFile:  The name of the file after we've downloaded it.
//   - mavenURL: The file and location of the jarfile to be downloaded (under Maven).
def fetchSingleFile(String jarFile, String mavenURL) {
    // Downloads the requested jarfile
    sh 'curl -L -o "sbom_dependencies/' + jarFile + '" "https://search.maven.org/classic/remotecontent?filepath=' + mavenURL + '"'

    // Puts the matching sha for the jarfile into the list of shas to check.
    def jarSHA = readFile(file : './temurin-build/cyclonedx-lib/dependency_data/shas/' + jarFile + '.sha256').replaceAll("\\s","")
    sh 'echo "' + jarSHA + '  sbom_dependencies/' + jarFile + '" >> sbom_dependency_shas.txt'
}

def fetchDeps() {
    def time_limit = 8
    if(params.TIME_LIMIT) {
        time_limit = params.TIME_LIMIT.toInteger()
    }
    timeout(time: time_limit, unit: 'HOURS') {
        try {
            // This allows us to easily specify which of our workspace files are to be archived later.
            sh 'mkdir sbom_dependencies'

            // These versions come from https://github.com/CycloneDX/cyclonedx-core-java/tags
            // Version->spec mappings are in https://github.com/CycloneDX/cyclonedx-core-java#cyclonedx-schema-support
            sh 'git clone -b ' + TEMURIN_BUILD_BRANCH + ' ' + TEMURIN_BUILD_REPO + ' temurin-build'
            def dep_data = WORKSPACE + "/temurin-build/cyclonedx-lib/dependency_data/"

            def cyclonedx_core_java_version = readFile(file : dep_data + 'versions/cyclonedx-core-java.jar.version').replaceAll("\\s","")
            def jackson_core_version = readFile(file : dep_data + 'versions/jackson-core.jar.version').replaceAll("\\s","")
            def jackson_annotations_version = readFile(file : dep_data + 'versions/jackson-annotations.jar.version').replaceAll("\\s","")
            def jackson_databind_version = readFile(file : dep_data + 'versions/jackson-databind.jar.version').replaceAll("\\s","")
            def json_schema_version = readFile(file : dep_data + 'versions/json-schema.jar.version').replaceAll("\\s","")
            def commons_codec_version = readFile(file : dep_data + 'versions/commons-codec.jar.version').replaceAll("\\s","")
            def commons_io_version = readFile(file : dep_data + 'versions/commons-io.jar.version').replaceAll("\\s","")
            def github_package_url_version = readFile(file : dep_data + 'versions/github-package-url.jar.version').replaceAll("\\s","")

            // Each of these fetches a jar in the format: fetchSingleFile(jar name post-download, current jar location under Maven)
            fetchSingleFile("cyclonedx-core-java.jar", "org/cyclonedx/cyclonedx-core-java/${cyclonedx_core_java_version}/cyclonedx-core-java-${cyclonedx_core_java_version}.jar")
            fetchSingleFile("jackson-core.jar", "com/fasterxml/jackson/core/jackson-core/${jackson_core_version}/jackson-core-${jackson_core_version}.jar")
            fetchSingleFile("jackson-dataformat-xml.jar", "com/fasterxml/jackson/dataformat/jackson-dataformat-xml/${jackson_databind_version}/jackson-dataformat-xml-${jackson_databind_version}.jar")
            fetchSingleFile("jackson-databind.jar", "com/fasterxml/jackson/core/jackson-databind/${jackson_databind_version}/jackson-databind-${jackson_databind_version}.jar")
            fetchSingleFile("jackson-annotations.jar", "com/fasterxml/jackson/core/jackson-annotations/${jackson_annotations_version}/jackson-annotations-${jackson_annotations_version}.jar")
            fetchSingleFile("json-schema.jar", "com/networknt/json-schema-validator/${json_schema_version}/json-schema-validator-${json_schema_version}.jar")
            fetchSingleFile("commons-codec.jar", "commons-codec/commons-codec/${commons_codec_version}/commons-codec-${commons_codec_version}.jar")
            fetchSingleFile("github-package-url.jar", "com/github/package-url/packageurl-java/${github_package_url_version}/packageurl-java-${github_package_url_version}.jar")
            fetchSingleFile("commons-io.jar", "commons-io/commons-io/${commons_io_version}/commons-io-${commons_io_version}.jar")


            // Check that every file matches the sha of the file we expected.
            sh 'sha256sum -c sbom_dependency_shas.txt'

            // Store all retrieved files on Jenkins, for use during sbom creation.
            archiveArtifacts '**/sbom_dependencies/*'
        } finally {
            // Clean up workspace.
            cleanWs()
        }
    }
}

return this
