#!/bin/bash
# 009 bacon — Stage1+combo4+FORTIFY + CVE clean + hi-batch1+2+3.
# Elevated CVE_MAX_ABS_OFFSET=9999 for high-offset lists. test-keys.
# Recover = hi-batch2 BOOT_OK boot.img.
set -e
cd /srv/rom/src/lineage
export HOME=/home/android-build
export CCACHE_DIR=/srv/rom/ccache
export USE_CCACHE=1
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
unset OUT_DIR || true
export SUNFISH_A16_MAGISK_PREROOT=1
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true

LOGDIR=/srv/rom/logs/009-build
mkdir -p "$LOGDIR"
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-batch3.log
exec > >(tee -a "$LOG") 2>&1

echo "=== START 009-bacon-axp-stage1-combo4-cve-hi-batch3 $(date -Is) ==="

LIVE=kernel/google/msm-4.14
BASE=28f9290ae067
KH=vendor/sunfish-a16/patches/009-kernel-hardening
LIST_CLEAN="$KH/cve-clean-offset.list"
LIST_HI1="$KH/cve-high-offset-batch1.list"
LIST_HI2="$KH/cve-high-offset-batch2.list"
LIST_HI3="$KH/cve-high-offset-batch3.list"
test -f "$LIST_CLEAN"
test -f "$LIST_HI1"
test -f "$LIST_HI2"
test -f "$LIST_HI3"
test -d "$LIVE"

echo "=== reset kernel @ $BASE ==="
git -C "$LIVE" reset --hard "$BASE"
git -C "$LIVE" clean -fdq

chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
  "$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true

bash "$KH/apply_stage1_combo4.sh" "$LIVE"

export CVE_STRICT_LIST="$LIST_CLEAN"
unset CVE_STRICT_CONTINUE || true
export CVE_MAX_FUZZ=1
export CVE_MAX_ABS_OFFSET=200
bash "$KH/apply_cve_strict.sh" "$LIVE"

export CVE_MAX_ABS_OFFSET=9999
for L in "$LIST_HI1" "$LIST_HI2" "$LIST_HI3"; do
  echo "=== high-offset $(basename "$L") ==="
  export CVE_STRICT_LIST="$L"
  bash "$KH/apply_cve_strict.sh" "$LIVE"
done

DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
  echo "FAIL: KernelSU in defconfig" >&2
  exit 1
fi
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
         SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
  grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
done
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 markers present"

rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
      out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
      out/target/product/sunfish/kernel

python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py

PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
test -e "$PH"
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
"$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM

MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
  vendor/sunfish-a16/magisk/prepare_magisk.sh
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
test -f out/.magisk/READY

rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
rm -f out/target/product/sunfish/lineage-*.zip \
      out/target/product/sunfish/boot.img \
      out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java

set +u
# shellcheck disable=SC1091
source build/envsetup.sh
set -e
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
breakfast sunfish userdebug
test "${TARGET_RELEASE:-}" = "bp4a"

echo "=== mka bacon $(date -Is) ==="
set -o pipefail
mka bacon -j8
ec=${PIPESTATUS[0]}
echo "bacon_exit=$ec $(date -Is)"
[ "$ec" -eq 0 ] || exit "$ec"

PROD=out/target/product/sunfish
BID=$(date -u +%Y%m%dT%H%M%SZ)
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-batch3
mkdir -p "$DEST"

TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
MAKE_BOOT=$PROD/boot.img
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
  cp -v "$TF_BOOT" "$DEST/boot.img"
  cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
else
  cp -v "$MAKE_BOOT" "$DEST/boot.img"
fi
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
for f in vbmeta.img dtbo.img; do
  [ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
done

WLAN=$PROD/vendor/lib/modules/wlan.ko
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
  KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
  MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
  echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
fi

if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
  echo "FAIL: KernelSU in boot" >&2
  exit 1
fi

{
  echo "artifact=$DEST"
  echo "list_clean=$LIST_CLEAN (429)"
  echo "list_hi1=$LIST_HI1"
  echo "list_hi2=$LIST_HI2"
  echo "list_hi3=$LIST_HI3"
  echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3"
  echo "cve_max_abs_offset_hi=9999"
  echo "signing=test-keys"
  echo "flash=fastboot flash boot; recover=hi-batch2 BOOT_OK"
  date -u +"built=%Y-%m-%dT%H:%M:%SZ"
} | tee "$DEST/README.txt"

(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
  | tee "$DEST/SHA256SUMS"

echo "=== DONE $DEST $(date -Is) ==="
# Force clean exit even if tee gets SIGPIPE on detach wrap
exit 0