#!/usr/bin/env bash
set -Eeuo pipefail
source /opt/rust-package-builder/scripts/lib.sh

: "${SOURCE_REPO:?SOURCE_REPO is required}"
SOURCE_BRANCH=${SOURCE_BRANCH:-master}
: "${REPOSITORY_URL:?REPOSITORY_URL is required}"
: "${OPNSENSE_REPOSITORY_URL:?OPNSENSE_REPOSITORY_URL is required}"
POLL_INTERVAL=${POLL_INTERVAL:-300}
PACKAGE_RELEASE=${PACKAGE_RELEASE:-auto}
OPNSENSE_ABI=${OPNSENSE_ABI:-26.7}
OPNSENSE_RETENTION=${OPNSENSE_RETENTION:-10}
FREEBSD_RELEASE=${FREEBSD_RELEASE:-15.1-RELEASE}
FREEBSD_ABI=${FREEBSD_ABI:-FreeBSD:15:amd64}
FREEBSD_ARCH=${FREEBSD_ARCH:-freebsd:15:x86:64}
FREEBSD_RUST_TOOLCHAIN=${FREEBSD_RUST_TOOLCHAIN:-1.88.0}
APPLY_FREEBSD_PATCHES=${APPLY_FREEBSD_PATCHES:-1}
RUN_LINUX_TESTS=${RUN_LINUX_TESTS:-1}
FREEBSD_NATIVE_ENABLED=${FREEBSD_NATIVE_ENABLED:-1}
FREEBSD_NATIVE_RETENTION=${FREEBSD_NATIVE_RETENTION:-10}

[[ "$POLL_INTERVAL" =~ ^[0-9]+$ ]] || fatal "POLL_INTERVAL must be an integer"
(( POLL_INTERVAL >= 1 )) || fatal "POLL_INTERVAL must be >= 1"
[[ "$PACKAGE_RELEASE" == "auto" || "$PACKAGE_RELEASE" =~ ^[1-9][0-9]*$ ]] || fatal "PACKAGE_RELEASE must be auto or a positive integer"
[[ "$OPNSENSE_RETENTION" =~ ^[0-9]+$ ]] || fatal "OPNSENSE_RETENTION must be >= 0"
[[ "$APPLY_FREEBSD_PATCHES" =~ ^[01]$ ]] || fatal "APPLY_FREEBSD_PATCHES must be 0 or 1"
[[ "$RUN_LINUX_TESTS" =~ ^[01]$ ]] || fatal "RUN_LINUX_TESTS must be 0 or 1"
[[ "$FREEBSD_NATIVE_ENABLED" =~ ^[01]$ ]] || fatal "FREEBSD_NATIVE_ENABLED must be 0 or 1"
[[ "$FREEBSD_NATIVE_RETENTION" =~ ^[0-9]+$ ]] || fatal "FREEBSD_NATIVE_RETENTION must be a nonnegative integer"
if [[ "$FREEBSD_NATIVE_ENABLED" != "1" ]]; then
    log 'WARNING: native FreeBSD build is disabled (FREEBSD_NATIVE_ENABLED=0); no FreeBSD packages will be published'
fi

export DATA_DIR=${DATA_DIR:-/var/lib/package-builder}
export SOURCE_REPO SOURCE_BRANCH REPOSITORY_URL OPNSENSE_REPOSITORY_URL POLL_INTERVAL
export REPO_DISTRIBUTION=${REPO_DISTRIBUTION:-stable}
export REPO_COMPONENT=${REPO_COMPONENT:-main}
export PACKAGE_RELEASE
export OPNSENSE_ABI OPNSENSE_RETENTION
export FREEBSD_RELEASE FREEBSD_ABI FREEBSD_ARCH FREEBSD_RUST_TOOLCHAIN
export APPLY_FREEBSD_PATCHES RUN_LINUX_TESTS FREEBSD_NATIVE_ENABLED FREEBSD_NATIVE_RETENTION
export MAX_GLIBC_VERSION=${MAX_GLIBC_VERSION:-2.34}
export GPG_PRIVATE_KEY_FILE=${GPG_PRIVATE_KEY_FILE:-/run/secrets/gpg/private-key.asc}
export GPG_PASSPHRASE_FILE=${GPG_PASSPHRASE_FILE:-/run/secrets/gpg/passphrase}
export GNUPGHOME=${GNUPGHOME:-/run/package-builder/gnupg}
export CARGO_HOME="$DATA_DIR/cargo"
export CARGO_TARGET_DIR="$DATA_DIR/cargo/target"

for cmd in git go cargo rustc rustup nfpm aptly createrepo_c gpg rsync python3 python3.11 \
    objdump ar rpm clang llvm-readelf llvm-ar llvm-ranlib file tar zstd bsdtar sha256sum; do
    require_cmd "$cmd"
done

rustc "+$FREEBSD_RUST_TOOLCHAIN" --version >/dev/null 2>&1 || fatal "FreeBSD Rust toolchain is unavailable: $FREEBSD_RUST_TOOLCHAIN"
rustup target list --toolchain "$FREEBSD_RUST_TOOLCHAIN" --installed | grep -Fx x86_64-unknown-freebsd >/dev/null \
    || fatal "Rust target x86_64-unknown-freebsd is not installed for $FREEBSD_RUST_TOOLCHAIN"

mkdir -p \
    "$DATA_DIR/repository/releases" \
    "$DATA_DIR/state" \
    "$DATA_DIR/cargo" \
    "$DATA_DIR/go/cache" \
    "$DATA_DIR/work" \
    "$DATA_DIR/packages/rpm/x86_64" \
    "$DATA_DIR/packages/suse/x86_64" \
    "$DATA_DIR/packages/deb"
mkdir -p "$GNUPGHOME"
chmod 0700 "$GNUPGHOME"

[[ -r "$GPG_PRIVATE_KEY_FILE" ]] || fatal "GPG private key not found: $GPG_PRIVATE_KEY_FILE"
log "importing GPG signing key"
gpg --batch --import "$GPG_PRIVATE_KEY_FILE" >/dev/null 2>&1 || fatal "cannot import GPG key"

if [[ -z "${GPG_KEY_ID:-}" ]]; then
    GPG_KEY_ID=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^sec:/ && !seen_sec {seen_sec=1; next} seen_sec && /^fpr:/ && first=="" {first=$10} END {print first}')
fi
[[ -n "$GPG_KEY_ID" ]] || fatal "cannot determine GPG key fingerprint"
export GPG_KEY_ID

if [[ -r "$GPG_PASSPHRASE_FILE" ]]; then
    NFPM_PASSPHRASE=$(cat "$GPG_PASSPHRASE_FILE")
    export NFPM_PASSPHRASE
else
    unset NFPM_PASSPHRASE || true
fi

/opt/rust-package-builder/scripts/init-storage.sh

log "builder started: branch=$SOURCE_BRANCH interval=${POLL_INTERVAL}s opnsense=$OPNSENSE_ABI freebsd=$FREEBSD_RELEASE native_freebsd=$FREEBSD_NATIVE_ENABLED"
while true; do
    if ! /opt/rust-package-builder/scripts/check-and-build.sh; then
        log "ERROR: one or more build branches failed; any successful branch was published independently"
    fi
    sleep "$POLL_INTERVAL"
done