#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
repo_name="${ALPINE_REPO_NAME:-local}"
arches="${ALPINE_ARCHES:-x86_64 aarch64}"
artifact_root="${APK_CI_ARTIFACTS_DIR:-${repo_root}/packages/worker-artifacts}"
package_root="${APK_CI_PACKAGE_ROOT:-${repo_root}/packages/${repo_name}}"
keys_root="$(mktemp -d)"

cleanup() {
  rm -rf "${keys_root}"
}
trap cleanup EXIT

require_command() {
  command -v "$1" >/dev/null 2>&1 || {
    printf 'missing required command: %s\n' "$1" >&2
    exit 2
  }
}

copy_key() {
  local key="$1"
  local destination="$2"
  local key_name

  key_name="$(basename "${key}")"
  if [[ -e "${destination}/${key_name}" ]]; then
    if cmp -s "${key}" "${destination}/${key_name}"; then
      return
    fi
    printf 'conflicting public keys named %s\n' "${key_name}" >&2
    exit 1
  fi
  cp "${key}" "${destination}/${key_name}"
}

require_command abuild-keygen
require_command abuild-sign
require_command apk

if [[ ! -d "${artifact_root}" ]]; then
  printf 'missing worker artifacts directory: %s\n' "${artifact_root}" >&2
  exit 1
fi

rm -rf "${package_root}"
mkdir -p "${package_root}" "${HOME}/.abuild"

if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
  abuild-keygen -a -n
fi

shopt -s nullglob
merge_private_keys=("${HOME}"/.abuild/*.rsa)
merge_public_keys=("${HOME}"/.abuild/*.rsa.pub)
shopt -u nullglob

if [[ "${#merge_private_keys[@]}" -ne 1 || "${#merge_public_keys[@]}" -ne 1 ]]; then
  printf 'expected exactly one merge signing key in %s/.abuild\n' "${HOME}" >&2
  exit 1
fi

for arch in ${arches}; do
  destination="${package_root}/${arch}"
  keys_dir="${keys_root}/${arch}"
  mkdir -p "${destination}"

  while IFS= read -r -d '' apk; do
    cp "${apk}" "${destination}/"
  done < <(find "${artifact_root}" -type f -path "*/${arch}/*.apk" -print0)

  shopt -s nullglob
  apks=("${destination}"/*.apk)
  shopt -u nullglob
  if [[ "${#apks[@]}" -eq 0 ]]; then
    rmdir "${destination}"
    continue
  fi

  while IFS= read -r -d '' key; do
    copy_key "${key}" "${destination}"
    mkdir -p "${keys_dir}"
    copy_key "${key}" "${keys_dir}"
  done < <(find "${artifact_root}" -type f -path "*/${arch}/*.rsa.pub" -print0)
  if ! compgen -G "${keys_dir}/*.rsa.pub" > /dev/null; then
    printf 'missing worker signing key for %s artifacts\n' "${arch}" >&2
    exit 1
  fi
  copy_key "${merge_public_keys[0]}" "${destination}"

  (
    cd "${destination}"
    apk --keys-dir "${keys_dir}" index --rewrite-arch "${arch}" -o APKINDEX.tar.gz ./*.apk
    abuild-sign -k "${merge_private_keys[0]}" APKINDEX.tar.gz
  )
done

if ! compgen -G "${package_root}"/*/*.apk > /dev/null; then
  printf 'no APK files found in worker artifacts: %s\n' "${artifact_root}" >&2
  exit 1
fi