# macOS Recovery BaseSystem.dmg from Apple's recovery servers (osrecovery.apple.com)
# via OSX-KVM's fetch-macOS-v2.py. The server has no stable URL (session-based) and,
# during a macOS rollout, "latest" is load-balanced across CDN nodes serving DIFFERENT
# builds (e.g. Sequoia and Tahoe at once). So the download is non-deterministic: the
# builder retries until it gets the exact build pinned by sha256. The recovery MUST
# match the installer's major version or startosinstall rejects it as "damaged".
# When Apple retires this build, update recovery.sha256 (download once, check
# /System/Library/CoreServices/SystemVersion.plist reports the wanted version).
{ pkgs, upstream, ... }:
{ shortname, sha256 }:
let
  script = pkgs.fetchurl { inherit (upstream.opencore.fetchRecoveryScript) url sha256; };
in
pkgs.runCommand "macos-${shortname}-BaseSystem.dmg" {
  nativeBuildInputs = [ pkgs.python3 pkgs.coreutils ];
  outputHashMode = "flat";
  outputHashAlgo = "sha256";
  outputHash = sha256;
  SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
  expected = sha256;
} ''
  cp ${script} fetch-macOS-v2.py
  sed -i 's/os.get_terminal_size().columns/80/' fetch-macOS-v2.py
  want=$(nix-hash --type sha256 --to-base16 "$expected" 2>/dev/null || echo "$expected")
  for attempt in $(seq 1 40); do
    rm -f BaseSystem.dmg BaseSystem.chunklist
    echo "=== vmix: fetching ${shortname} recovery (attempt $attempt) ==="
    python3 fetch-macOS-v2.py --action download -s ${shortname} -o . -n BaseSystem || true
    if [ -f BaseSystem.dmg ]; then
      got=$(sha256sum BaseSystem.dmg | cut -d' ' -f1)
      echo "got $got (want $want)"
      [ "$got" = "$want" ] && { mv BaseSystem.dmg $out; exit 0; }
      echo "=== vmix: wrong build (Apple is rotating builds during rollout), retrying ==="
    fi
    sleep 5
  done
  echo "vmix: could not fetch the pinned ${shortname} recovery after 40 attempts."
  echo "Apple may have retired build $want; download it manually and update recovery.sha256."
  exit 1
''