#!/usr/bin/env sh
set -eu

ANDROID_SDK_ROOT=/opt/android-sdk
GRADLE_HOME=/opt/gradle/gradle-8.9
TOOLS_ZIP=/tmp/filyx-android-command-tools.zip
GRADLE_ZIP=/tmp/filyx-gradle-8.9.zip
SECRETS_DIR=/srv/filyx-secrets
# The previous signing archive cannot be opened with its stored password.
# Use a new stable, server-protected identity from 1.3.1 onward.  Android will
# ask existing users to remove the obsolete tracker once before installing it.
KEYSTORE_FILE=$SECRETS_DIR/filyx-irl-android-v3-release.jks
PASSWORD_FILE=$SECRETS_DIR/filyx-irl-android-v3-release.password
PUBLIC_APK=/srv/filyx/apps/web/public/downloads/FilyX-IRL-Tracker-Android.apk

sudo apt-get update
sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y openjdk-17-jdk-headless unzip wget openssl

if [ ! -x "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" ]; then
  wget -q https://redirector.gvt1.com/edgedl/android/repository/commandlinetools-linux-15859902_latest.zip -O "$TOOLS_ZIP"
  echo "4e4c464f145a7512b57d088ac6c278c03c9eea610886b35a5e0804e74eedf583  $TOOLS_ZIP" | sha256sum -c -
  sudo install -d "$ANDROID_SDK_ROOT/cmdline-tools"
  sudo unzip -q "$TOOLS_ZIP" -d "$ANDROID_SDK_ROOT/cmdline-tools"
  sudo mv "$ANDROID_SDK_ROOT/cmdline-tools/cmdline-tools" "$ANDROID_SDK_ROOT/cmdline-tools/latest"
fi

yes | sudo env ANDROID_SDK_ROOT="$ANDROID_SDK_ROOT" "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null
sudo env ANDROID_SDK_ROOT="$ANDROID_SDK_ROOT" "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" "platforms;android-35" "build-tools;34.0.0" "build-tools;35.0.0" "platform-tools"

if [ ! -x "$GRADLE_HOME/bin/gradle" ]; then
  wget -q https://services.gradle.org/distributions/gradle-8.9-bin.zip -O "$GRADLE_ZIP"
  sudo install -d /opt/gradle
  sudo unzip -q "$GRADLE_ZIP" -d /opt/gradle
fi

export ANDROID_SDK_ROOT
export ANDROID_HOME="$ANDROID_SDK_ROOT"
cd "$(dirname "$0")/android"
# Earlier remote builds may have been run by root.  Remove only Gradle's
# generated output so the regular deploy user can build reproducibly.
sudo rm -rf "$PWD/app/build"
"$GRADLE_HOME/bin/gradle" --no-daemon assembleRelease

sudo install -d -m 700 "$SECRETS_DIR"
if [ ! -f "$KEYSTORE_FILE" ]; then
  sudo sh -c "umask 077; openssl rand -hex 24 > '$PASSWORD_FILE'"
  STORE_PASSWORD=$(sudo cat "$PASSWORD_FILE")
  sudo keytool -genkeypair -v -keystore "$KEYSTORE_FILE" -storepass "$STORE_PASSWORD" -keypass "$STORE_PASSWORD" -alias filyx-irl -keyalg RSA -keysize 4096 -validity 10000 -dname "CN=FilyX, OU=Mobile, O=FilyX, L=Contrexeville, C=FR"
fi

BUILD_TOOLS="$ANDROID_SDK_ROOT/build-tools/35.0.0"
UNSIGNED_APK=app/build/outputs/apk/release/app-release-unsigned.apk
ALIGNED_APK=app/build/outputs/apk/release/app-release-aligned.apk
"$BUILD_TOOLS/zipalign" -f -p 4 "$UNSIGNED_APK" "$ALIGNED_APK"
sudo install -d /srv/filyx/apps/web/public/downloads
sudo "$BUILD_TOOLS/apksigner" sign --ks "$KEYSTORE_FILE" --ks-key-alias filyx-irl --ks-pass "file:$PASSWORD_FILE" --out "$PUBLIC_APK" "$ALIGNED_APK"
sudo "$BUILD_TOOLS/apksigner" verify --verbose "$PUBLIC_APK"
sudo chmod 0644 "$PUBLIC_APK"
echo "APK_READY $PUBLIC_APK"