#!/bin/sh
set -eu
version=$1
here=$(pwd)
root=${PACKAGES_ROOT:-/var/www/packages.arasaka.software}
keep=${FDROID_KEEP:-3}
url=https://packages.arasaka.software/fdroid/repo
fingerprint=5F52CFF4F52F4E0B6DA6CD044BFCEAF78D1D42DB24F2470602DB7F19CBFDF846
id=software.arasaka.meweb
apk=$here/releases/$version/MeWeb-$version-android.apk
test -f "$apk"
if [ -z "${MEWEB_KEYSTORE_B64:-}" ] || [ -z "${MEWEB_KEYSTORE_PASS:-}" ]; then
  echo "::error::the repository secrets MEWEB_KEYSTORE_B64 and MEWEB_KEYSTORE_PASS are not set"
  exit 1
fi
major=$(echo "$version" | cut -d. -f1)
minor=$(echo "$version" | cut -d. -f2)
patch=$(echo "$version" | cut -d. -f3)
code=$((major * 10000 + minor * 100 + patch))

tools/setup.sh --group fdroid
tools=$(cd "$here/tools/fdroid/linux-x64" && pwd -P)
pinned=$(sed -n 's/^fdroidserver==\([^ ]*\).*/\1/p' packaging/fdroid/requirements.txt)
venv=$tools/fdroidserver-$pinned
if ! "$venv/bin/fdroid" --version > /dev/null 2>&1; then
  rm -rf "$venv"
  UV_CACHE_DIR=$tools/cache UV_PYTHON_INSTALL_DIR=$tools/python "$tools/uv-x86_64-unknown-linux-gnu/uv" venv -q --python 3.12 "$venv"
  UV_CACHE_DIR=$tools/cache "$tools/uv-x86_64-unknown-linux-gnu/uv" pip install -q --python "$venv/bin/python" --require-hashes -r packaging/fdroid/requirements.txt
fi
JAVA_HOME=$(ls -d "$here"/tools/jdk/linux-x64/*/ | head -n 1)
ANDROID_HOME=$here/tools/android-sdk
PATH=$JAVA_HOME/bin:$PATH
export JAVA_HOME ANDROID_HOME PATH

exec 9>>"$root/.lock"
flock -w 2700 9

keys=$(mktemp -d)
trap 'rm -rf "$keys"' EXIT
(umask 077 && printf '%s' "$MEWEB_KEYSTORE_B64" | base64 -d > "$keys/meweb.keystore")
MEWEB_KEYSTORE=$keys/meweb.keystore
export MEWEB_KEYSTORE MEWEB_KEYSTORE_PASS
unset MEWEB_KEYSTORE_B64
held=$(keytool -J-Duser.language=en -list -v -keystore "$MEWEB_KEYSTORE" -storepass:env MEWEB_KEYSTORE_PASS -alias meweb | sed -n 's/^.*SHA256: *//p' | tr -d ':')
test "$held" = "$fingerprint"

state=$root/.fdroid
snap=$state/$(date -u +%Y%m%d%H%M%S)-$version
mkdir -p "$snap/repo" "$snap/metadata" "$snap/tmp"
if [ -e "$root/fdroid/repo" ]; then
  prior=$(readlink -f "$root/fdroid/repo")/..
  for file in "$prior"/repo/*.apk; do
    [ -e "$file" ] && ln "$file" "$snap/repo/"
  done
  cp -a "$prior/metadata/." "$snap/metadata/"
  cp "$prior/repo/index-v2.json" "$snap/repo/"
  if [ -f "$prior/tmp/apkcache.json" ]; then cp "$prior/tmp/apkcache.json" "$snap/tmp/"; fi
fi
cp packaging/fdroid/config.yml "$snap/config.yml"
chmod 600 "$snap/config.yml"
cp packaging/fdroid/icon.png "$snap/icon.png"
cp -r packaging/fdroid/metadata/. "$snap/metadata/"
rm -f "$snap/repo/${id}_$code.apk"
cp "$apk" "$snap/repo/${id}_$code.apk"
(cd "$snap/repo" && ls "$id"_*.apk | sed 's/.*_\([0-9]*\)\.apk$/\1/' | sort -n | head -n "-$keep" | while read -r old; do
  rm -f "${id}_$old.apk"
done)

(cd "$snap" && "$venv/bin/fdroid" update)
rm -rf "$snap/repo/status"
chmod -R u=rwX,go=rX "$snap/repo"

mkdir -p "$root/fdroid"
ln -sfn "../.fdroid/$(basename "$snap")/repo" "$root/fdroid/repo.new"
mv -T -f "$root/fdroid/repo.new" "$root/fdroid/repo"
ls -1d "$state"/*/ | sort | head -n -3 | while read -r old; do
  find "$old" -maxdepth 0 -mmin +1440 -exec rm -rf {} +
done
echo "published ${id}_$code.apk in $root/fdroid/repo"

if [ "$root" = /var/www/packages.arasaka.software ]; then
  curl -fsS "$url/entry.jar" -o "$keys/entry.jar"
  signed=$(keytool -J-Duser.language=en -printcert -jarfile "$keys/entry.jar" | sed -n 's/^.*SHA256: *//p' | head -n 1 | tr -d ':')
  test "$signed" = "$fingerprint"
  curl -fsS "$url/index-v2.json" | grep -Eq "\"versionCode\": ?$code\b"
  curl -fsSI "$url/${id}_$code.apk" > /dev/null
  echo "live at $url: $id $version ($code)"
fi