#!/bin/sh
# The AppImage entry point.
#
# Everything below exists because the image carries its own interpreter and
# its own Node, and the mount they live on is READ-ONLY and disappears when
# the app exits. Anything that assumes a normal install has to be told.
set -e
HERE="$(dirname "$(readlink -f "$0")")"

# Our node must win over any the host happens to have: config.py reads
# $NODE (config.py:174), and the editor's export path runs it directly.
export PATH="$HERE/usr/bin:$PATH"
export NODE="$HERE/usr/bin/node"

# A host PYTHONHOME/PYTHONPATH aimed at a different interpreter is the
# classic way a bundled Python picks up a foreign stdlib and dies
# confusingly. selftest.check_environment warns about these; we prevent
# them instead.
unset PYTHONHOME PYTHONPATH

# The mount is read-only. Bytecode was compiled at build time; without
# this, every import tries to write a .pyc and silently fails.
export PYTHONDONTWRITEBYTECODE=1

# python-build-standalone's OpenSSL looks for its CA bundle at the path it
# was BUILT with, which does not exist here — so the system trust store
# comes up empty. net.py deliberately trusts the OS store AND certifi so
# each covers the other's blind spot (a corporate TLS-intercepting proxy
# lives only in the OS store; a stale distro bundle is why certifi is
# there). Without this the OS half is silently gone and the self-test's
# "system+certifi" row quietly becomes "certifi only".
if [ -z "${SSL_CERT_FILE:-}" ]; then
    for c in /etc/ssl/certs/ca-certificates.crt \
             /etc/pki/tls/certs/ca-bundle.crt \
             /etc/ssl/ca-bundle.pem \
             /etc/ssl/cert.pem; do
        if [ -r "$c" ]; then export SSL_CERT_FILE="$c"; break; fi
    done
fi
if [ -z "${SSL_CERT_DIR:-}" ] && [ -d /etc/ssl/certs ]; then
    export SSL_CERT_DIR=/etc/ssl/certs
fi

exec "$HERE/usr/lib/python/bin/python3" "$HERE/usr/lib/clipshelf/run.py" "$@"
