#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
repo_name="${ALPINE_REPO_NAME:-local}"
arches="${ALPINE_ARCHES:-x86_64 aarch64}"
artifact_root="${APK_CI_ARTIFACTS_DIR:-${repo_root}/packages/worker-artifacts}"
package_root="${APK_CI_PACKAGE_ROOT:-${repo_root}/packages/${repo_name}}"

require_command() {
  command -v "$1" >/dev/null 2>&1 || {
    printf 'missing required command: %s\n' "$1" >&2
    exit 2
  }
}

copy_key() {
  local key="$1"
  local destination="$2"
  local digest

  digest="$(sha256sum "${key}" | awk '{print $1}')"
  cp "${key}" "${destination}/${digest}.rsa.pub"
}

require_command abuild-keygen
require_command abuild-sign
require_command apk

if [[ ! -d "${artifact_root}" ]]; then
  printf 'missing worker artifacts directory: %s\n' "${artifact_root}" >&2
  exit 1
fi

rm -rf "${package_root}"
mkdir -p "${package_root}" "${HOME}/.abuild"

if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
  abuild-keygen -a -n
fi

shopt -s nullglob
merge_private_keys=("${HOME}"/.abuild/*.rsa)
merge_public_keys=("${HOME}"/.abuild/*.rsa.pub)
shopt -u nullglob

if [[ "${#merge_private_keys[@]}" -ne 1 || "${#merge_public_keys[@]}" -ne 1 ]]; then
  printf 'expected exactly one merge signing key in %s/.abuild\n' "${HOME}" >&2
  exit 1
fi

for arch in ${arches}; do
  destination="${package_root}/${arch}"
  mkdir -p "${destination}"

  while IFS= read -r -d '' apk; do
    cp "${apk}" "${destination}/"
  done < <(find "${artifact_root}" -type f -path "*/${arch}/*.apk" -print0)

  shopt -s nullglob
  apks=("${destination}"/*.apk)
  shopt -u nullglob
  if [[ "${#apks[@]}" -eq 0 ]]; then
    rmdir "${destination}"
    continue
  fi

  while IFS= read -r -d '' key; do
    copy_key "${key}" "${destination}"
  done < <(find "${artifact_root}" -type f -path "*/${arch}/*.rsa.pub" -print0)
  copy_key "${merge_public_keys[0]}" "${destination}"

  (
    cd "${destination}"
    apk index --rewrite-arch "${arch}" -o APKINDEX.tar.gz ./*.apk
    abuild-sign -k "${merge_private_keys[0]}" APKINDEX.tar.gz
  )
done

if ! compgen -G "${package_root}"/*/*.apk > /dev/null; then
  printf 'no APK files found in worker artifacts: %s\n' "${artifact_root}" >&2
  exit 1
fi