#!/usr/bin/env bash
# Independently re-verify the manifest. Needs only curl and sha256sum.
set -euo pipefail
URL="https://genmitsu.s3.us-east-1.amazonaws.com/101-60-3030PVM/3030_PROVerMAX_Firmware_V3.0.zip"
EXPECT_ZIP="cb044bc6757d59a1e4ba79f5a99f1967245684eee8c0f1d4ade31aa6f26a7e04"
EXPECT_FW="582322cd7bb8ae4c159376330e2731ca1281a35472ea9968558d6091343a911f"
tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
echo "1. fetching with no credentials..."
curl -sSI --max-time 60 "$URL" | head -1
curl -sS --max-time 300 -o "$tmp/fw.zip" "$URL"
got=$(sha256sum "$tmp/fw.zip" | cut -d' ' -f1)
echo "2. zip sha256 $got"
[ "$got" = "$EXPECT_ZIP" ] && echo "   MATCHES the published file" || { echo "   MISMATCH (file changed since capture)"; exit 1; }
unzip -oq "$tmp/fw.zip" -d "$tmp/x"
fw=$(find "$tmp/x" -iname firmware.bin | head -1)
gotf=$(sha256sum "$fw" | cut -d' ' -f1)
echo "3. firmware.bin sha256 $gotf"
[ "$gotf" = "$EXPECT_FW" ] && echo "   MATCHES" || { echo "   MISMATCH"; exit 1; }
echo "4. grbl banner in the binary:"
grep -ao "Grbl 1.1f \['\$' for help\]" "$fw" || echo "   NOT FOUND"
echo "5. licence notices:"
if grep -aiqE "gpl|gnu|general public|copyright|licens|free software" "$fw"; then
  echo "   something found - inspect"; else echo "   NONE (as documented)"; fi
echo "DONE."