#!/usr/bin/env bash
#
# build.sh — build the three stand-in RPMs, the repo that serves them, and
# every base image variant.
#
# Everything lands in state/, which is gitignored. Deleting that directory is
# how to start clean; nothing here reads anything it did not put there.
#
# Rootful podman, because bootc install has to find the image in the same
# container store it runs out of, and a rootless-to-rootful copy of a 2 GB
# image is a slower way to arrive at the same place. That matches
# build-image.sh, which is rootful for the same reason.
set -euo pipefail

# shellcheck source=build/layertest/common.sh
. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"

# shellcheck source=build/privilege.sh
. "$HERE/../privilege.sh"

mkdir -p "$STATE/rpms"

# ---------------------------------------------------------------- the RPMs
# Built in a container rather than on the host: rpmbuild and createrepo_c are
# not on a dev box by default, and the packages have to be fc43 to install into
# an fc43 base without an %{dist} mismatch nobody wants to debug.
say "building alloy-demo 0.0.1, 0.0.2 and 0.0.3"
podman run --rm -v "$HERE:/spec:ro,z" -v "$STATE:/state:z" -w /state \
  registry.fedoraproject.org/fedora:43 bash -c '
    set -e
    dnf -y install rpm-build createrepo_c >/dev/null 2>&1
    for v in 0.0.1 0.0.2 0.0.3; do
      rpmbuild --define "_topdir /state/rpmbuild" --define "demo_version $v" \
        -bb /spec/alloy-demo.spec >/dev/null
    done
    rm -rf /state/repo && mkdir -p /state/repo
    cp /state/rpmbuild/RPMS/*/*.rpm /state/repo/
    cp /state/rpmbuild/RPMS/*/*.rpm /state/rpms/
    createrepo_c /state/repo >/dev/null

    # And one repo per version, for the `carry` shape. A carried repo holding
    # every version would let a machine resolve a version its image never
    # shipped, so moving the base from one carry variant to the next would
    # prove nothing.
    rm -rf /state/repos && mkdir -p /state/repos
    for v in 0.0.1 0.0.2 0.0.3; do
      mkdir -p "/state/repos/$v"
      cp "/state/rpmbuild/RPMS"/*/alloy-demo-$v-*.rpm "/state/repos/$v/"
      createrepo_c "/state/repos/$v" >/dev/null
    done
  ' >/dev/null

# ------------------------------------------------------- the build context
# Written rather than tracked, because both files name a port that lives in
# common.sh, and two copies of a port number is one too many.
#
# Unsigned and insecure on purpose. Signing is its own subtask, and mixing it
# in here would add a way for a run to fail that has nothing to do with what is
# being measured.
cat > "$STATE/alloy-demo.repo" <<EOF
[alloy-demo]
name=alloy-demo hotfix channel (experiment)
baseurl=http://$HOST_FROM_GUEST:$REPO_PORT/
enabled=1
gpgcheck=0
EOF

cat > "$STATE/registries.conf" <<EOF
[[registry]]
location = "$HOST_FROM_GUEST:$REGISTRY_PORT"
insecure = true
EOF

# The guest is driven over ssh, so the key that drives it has to be in the
# image. Copied at build time rather than committed.
[ -f "$HOME/.ssh/id_ed25519.pub" ] || die "no ~/.ssh/id_ed25519.pub to authorize"
cp "$HOME/.ssh/id_ed25519.pub" "$STATE/authorized_keys"

# ------------------------------------------------------------- the images
for variant in "${VARIANTS[@]}"; do
  mark="${variant%%:*}"
  rest="${variant#*:}"
  shape="${rest%%:*}"
  version="${rest#*:}"
  say "building $IMAGE:$mark (shape=$shape version=${version:-none})"
  privc podman build \
    -f "$HERE/Containerfile" \
    --build-arg "SHAPE=$shape" \
    --build-arg "DEMO_VERSION=${version:-0.0.1}" \
    --build-arg "BASE_MARK=$mark" \
    -t "$IMAGE:$mark" \
    "$STATE" >/dev/null
done

say "built: $(printf '%s ' "${VARIANTS[@]%%:*}")"