#!/usr/bin/env bash
# scripts/update-tzgeo.sh <version>, e.g. 2026b
#
# Refreshes internal/geo/data from one IANA tzdata release
# (nearest-region spec §6.2). zone.tab carries the coordinates; the Link
# lines resolve the old names browsers still report (Asia/Calcutta). Run it
# as a release-checklist step beside the Go toolchain bump; a stale table
# only misses zone names newer than it, and those fall through to IP.
set -euo pipefail
# Paul Eggert's tzdata signing key: the only signer this script accepts.
tz_signer=7E3792A9D8ACF7D633BC1588ED97E90E62AA7E34
v="${1:?usage: update-tzgeo.sh <tzdata version, e.g. 2026b>}"
here="$(cd "$(dirname "$0")/.." && pwd)"
out="$here/internal/geo/data"
work="$(mktemp -d "${TMPDIR:-/tmp}/tzgeo.XXXXXX")"
trap 'rm -rf "$work"' EXIT
base="https://data.iana.org/time-zones/releases"
curl -fsSL -o "$work/tzdata.tar.gz" "$base/tzdata$v.tar.gz"
curl -fsSL -o "$work/tzdata.tar.gz.asc" "$base/tzdata$v.tar.gz.asc"
if command -v gpg >/dev/null; then
  status="$(gpg --status-fd 1 --verify "$work/tzdata.tar.gz.asc" "$work/tzdata.tar.gz")"
  # VALIDSIG's 12th field is the signing key's primary fingerprint. An
  # expired key still gives VALIDSIG, which is fine: the signature predates it.
  printf '%s\n' "$status" |
    awk -v fp="$tz_signer" '$2 == "VALIDSIG" && $12 == fp { ok = 1 } END { exit !ok }' || exit 1
else
  echo "gpg not found: signature NOT checked" >&2
  exit 1
fi
tar -xzf "$work/tzdata.tar.gz" -C "$work"
mkdir -p "$out"
cp "$work/zone.tab" "$out/zone.tab"
awk '$1 == "Link" { print $2, $3 }' \
  "$work"/africa "$work"/antarctica "$work"/asia "$work"/australasia \
  "$work"/backward "$work"/etcetera "$work"/europe "$work"/northamerica \
  "$work"/southamerica | sort -u > "$out/links.txt"
printf '%s\n' "$v" > "$out/VERSION"
echo "internal/geo/data refreshed to tzdata $v"