#!/bin/sh
# autopkgtest for libzpc2-tools: zpckey
#
# This is a portable (architecture-independent) smoke test for the
# zpckey key management tool. It does not require any IBM Z specific
# hardware (CPACF/CEX), since composing/inspecting a protected-key
# origin file is pure metadata handling: the actual protected-key
# operations are only performed by the hbkzpc OpenSSL provider
# (libzpc2-provider, s390x only) at runtime.

set -e

WORKDIR="$(mktemp -d)"
trap 'rm -rf "$WORKDIR"' EXIT INT TERM

ORIGIN="$WORKDIR/origin.pem"
COMMENT="autopkgtest-$$"

echo "== zpckey --version =="
zpckey --version

echo "== zpckey compose (uv/AES-256 origin) =="
zpckey compose \
	-t uv \
	-a AES-256 \
	--uv-secret-name "autopkgtest-secret" \
	-c "$COMMENT" \
	-o "$ORIGIN"

test -s "$ORIGIN"
echo "-- composed origin file: $ORIGIN --"
cat "$ORIGIN"

echo "== zpckey show (round-trip check) =="
OUTPUT="$(zpckey show -i "$ORIGIN")"
echo "$OUTPUT"

echo "$OUTPUT" | grep -q 'origin-type=uv'
echo "$OUTPUT" | grep -q 'origin-alg=AES-256'
echo "$OUTPUT" | grep -q "comment=$COMMENT"

echo "PASS: zpckey compose/show smoke test"
