#!/bin/sh
# Build one Debian package.
#   build-deb.sh <client|server> <version> <arch> <output.deb>
set -eu

kind=$1
version=$2
arch=$3
out=$4

root=$(cd "$(dirname "$0")/.." && pwd)
stage=$root/build/deb-$kind-$arch
rm -rf "$stage"

case $kind in
client)
	pkg=keeporg
	binary=keeporg
	mkdir -p "$stage/usr/bin" "$stage/usr/lib/systemd/user" \
		"$stage/usr/share/applications" "$stage/usr/share/icons"
	install -m 0755 "$root/build/linux-$arch/keeporg" "$stage/usr/bin/keeporg"
	install -m 0644 "$root/packaging/systemd/keeporg.service" \
		"$stage/usr/lib/systemd/user/keeporg.service"
	# The tray application: a menu entry, and the icon it and the tray use.
	install -m 0644 "$root/packaging/linux/keeporg.desktop" \
		"$stage/usr/share/applications/keeporg.desktop"
	cp -R "$root/build/icons/hicolor" "$stage/usr/share/icons/hicolor"
	rm -f "$stage/usr/share/icons/hicolor/.stamp"
	find "$stage/usr/share/icons" -type d -exec chmod 0755 {} + -o -type f -exec chmod 0644 {} +
	;;
server)
	pkg=keeporgd
	binary=keeporgd
	mkdir -p "$stage/usr/bin" "$stage/usr/lib/systemd/system" "$stage/etc/keeporg"
	install -m 0755 "$root/build/linux-$arch/keeporgd" "$stage/usr/bin/keeporgd"
	install -m 0644 "$root/packaging/systemd/keeporgd.service" \
		"$stage/usr/lib/systemd/system/keeporgd.service"
	"$root/build/linux-$arch/keeporgd" -write-config "$stage/etc/keeporg/server.json" >/dev/null
	chmod 0640 "$stage/etc/keeporg/server.json"
	;;
*)
	echo "build-deb.sh: unknown package kind $kind" >&2
	exit 2
	;;
esac

mkdir -p "$stage/DEBIAN" "$stage/usr/share/doc/$pkg"
sed -e "s/@VERSION@/$version/" -e "s/@ARCH@/$arch/" \
	"$root/packaging/deb/$kind/control.in" > "$stage/DEBIAN/control"
install -m 0644 "$root/packaging/deb/copyright" "$stage/usr/share/doc/$pkg/copyright"
# A version without a Debian revision is a native package, whose changelog
# Debian policy names changelog.gz rather than changelog.Debian.gz.
case $version in
*-*) changelog=changelog.Debian.gz ;;
*) changelog=changelog.gz ;;
esac
gzip -9nc "$root/packaging/deb/$kind/changelog" > "$stage/usr/share/doc/$pkg/$changelog"
chmod 0644 "$stage/usr/share/doc/$pkg/$changelog"
# Go links statically on purpose: one binary, no libc dependency.
mkdir -p "$stage/usr/share/lintian/overrides"
printf '%s: statically-linked-binary [usr/bin/%s]\n' "$pkg" "$binary" \
	> "$stage/usr/share/lintian/overrides/$pkg"
if [ "$kind" = server ]; then
	# The config may carry the OIDC client secret, so it is not world-readable.
	echo "$pkg: non-standard-file-perm 0640 != 0644 [etc/keeporg/server.json]" \
		>> "$stage/usr/share/lintian/overrides/$pkg"
fi
chmod 0644 "$stage/usr/share/lintian/overrides/$pkg"

if [ "$kind" = server ]; then
	cat > "$stage/DEBIAN/conffiles" <<'CONF'
/etc/keeporg/server.json
CONF
	cat > "$stage/DEBIAN/postinst" <<'POST'
#!/bin/sh
set -e
if [ "$1" = configure ]; then
	if ! getent passwd keeporg >/dev/null; then
		adduser --system --group --home /var/lib/keeporg \
			--gecos "KeepOrg synchronization server" keeporg
	fi
	install -d -o keeporg -g keeporg -m 0700 /var/lib/keeporg
	chgrp keeporg /etc/keeporg /etc/keeporg/server.json || true
	chmod 0750 /etc/keeporg || true
	chmod 0640 /etc/keeporg/server.json || true
	# The service cannot write /etc (ProtectSystem=strict), and without its
	# master key the server does not start, so the key is made here, once.
	# It is never replaced: a new key opens nothing that is already stored.
	if [ ! -e /etc/keeporg/master.key ]; then
		(umask 077 && head -c 32 /dev/urandom | base64 > /etc/keeporg/master.key)
		chgrp keeporg /etc/keeporg/master.key
		chmod 0640 /etc/keeporg/master.key
	fi
	if [ -d /run/systemd/system ]; then
		systemctl daemon-reload || true
		echo "keeporgd: edit /etc/keeporg/server.json, then" \
		     "systemctl enable --now keeporgd" >&2
		echo "keeporgd: the master key is /etc/keeporg/master.key; everything" \
		     "the server stores is encrypted under it. Back it up separately" \
		     "from the database: losing it loses the data" >&2
	fi
fi
exit 0
POST
	cat > "$stage/DEBIAN/prerm" <<'PRERM'
#!/bin/sh
set -e
if [ "$1" = remove ] && [ -d /run/systemd/system ]; then
	deb-systemd-invoke stop keeporgd.service || true
fi
exit 0
PRERM
	chmod 0755 "$stage/DEBIAN/postinst" "$stage/DEBIAN/prerm"
fi

# Whatever the builder's umask, packaged directories are 0755; postinst
# tightens /etc/keeporg itself.
find "$stage" -type d -exec chmod 0755 {} +

mkdir -p "$(dirname "$out")"
fakeroot dpkg-deb --root-owner-group --build "$stage" "$out" >/dev/null
printf 'built %s (%s %s %s)\n' "$out" "$binary" "$version" "$arch"