#!/usr/bin/env bash
set -euo pipefail
: "${ROOT_FILE:=ROOT.txt}"
: "${TSA_URL:=https://freetsa.org/tsr}"
: "${DRY_RUN:=1}"
: "${CONFIRM_PHRASE:=I UNDERSTAND THIS WILL ANCHOR A ROOT VIA TSA}"

[[ "$DRY_RUN" == "0" ]] || { echo "DRY_RUN=1"; exit 1; }
echo "Type confirmation:"
read -r x; [[ "$x" == "$CONFIRM_PHRASE" ]] || exit 1

openssl ts -query -data "$ROOT_FILE" -sha256 -certreq -out request.tsq
curl -s -H "Content-Type: application/timestamp-query" \
  --data-binary @request.tsq "$TSA_URL" > response.tsr

cat > PROOF.json <<EOF
{
  "skill":"rfc3161-anchor",
  "root_file":"$ROOT_FILE",
  "tsa":"$TSA_URL",
  "timestamp":"$(date -Iseconds)"
}
EOF
echo "[OK] anchored"