#!/bin/bash
# 009 bacon — Magisk preroot + Stage1 Graphene/AH + combo4 Clang FORTIFY.
# Full zip so vendor modules match kernel (Wi-Fi). LAB flash only after gates.
set -e
cd /srv/rom/src/lineage
export HOME=/home/android-build
export CCACHE_DIR=/srv/rom/ccache
export USE_CCACHE=1
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
unset OUT_DIR || true
export SUNFISH_A16_MAGISK_PREROOT=1
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk

LOGDIR=/srv/rom/logs/009-build
mkdir -p "$LOGDIR"
LOG=$LOGDIR/bacon-axp-stage1-combo4.log
exec > >(tee -a "$LOG") 2>&1

echo "=== START 009-bacon-axp-stage1-combo4 $(date -Is) ==="

LIVE=kernel/google/msm-4.14
BASE=28f9290ae067
test -d "$LIVE"

echo "=== reset kernel @ $BASE ==="
git -C "$LIVE" reset --hard "$BASE"
git -C "$LIVE" clean -fdq

APPLY=vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh
test -x "$APPLY" || chmod +x "$APPLY"
bash "$APPLY" "$LIVE"

DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
  echo "FAIL: $DEF still enables KernelSU" >&2
  exit 1
fi
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
         SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
  if ! grep -q "^CONFIG_${k}=y" "$DEF"; then
    echo "FAIL: missing CONFIG_${k}=y" >&2
    exit 1
  fi
done
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
# Stage1 marker (Deny USB / sysctl)
if ! grep -q "deny_new_usb" "$LIVE/kernel/sysctl.c" \
  && ! grep -qE "deny_new_usb|CONFIG_DENY_NEW_USB|usb_device_authorization" \
       "$LIVE/drivers/usb/core/hub.c"; then
  echo "FAIL: Stage1 Deny_USB markers missing" >&2
  exit 1
fi
echo "OK: Stage1 + combo4+FORTIFY markers present"

rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
      out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
      out/target/product/sunfish/kernel
echo "OK: cleared prior Image for kernel rebuild"

python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py

PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
test -e "$PH"
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
if ! "$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM; then
  echo "FAIL: Phonesky missing USE_EXACT_ALARM" >&2
  exit 1
fi
echo "OK: Phonesky has USE_EXACT_ALARM"

MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
  vendor/sunfish-a16/magisk/prepare_magisk.sh
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
test -f out/.magisk/READY

rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
rm -f out/target/product/sunfish/lineage-*.zip \
      out/target/product/sunfish/boot.img \
      out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java

set +u
# shellcheck disable=SC1091
source build/envsetup.sh
set -e

# US-S2: project release keys when present (Gate G). Fallback = AOSP test-keys.
CERT_DIR="${ANDROID_CERTS_DIR:-$HOME/.android-certs}"
if [[ -f "$CERT_DIR/releasekey.pk8" && -f "$CERT_DIR/releasekey.x509.pem" ]]; then
  export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
  echo "OK: PRODUCT_DEFAULT_DEV_CERTIFICATE=$PRODUCT_DEFAULT_DEV_CERTIFICATE"
else
  echo "WARN: no $CERT_DIR/releasekey — building with AOSP test-keys"
fi

breakfast sunfish userdebug
test "${TARGET_RELEASE:-}" = "bp4a"

echo "=== mka bacon $(date -Is) ==="
set -o pipefail
mka bacon -j8
ec=${PIPESTATUS[0]}
echo "bacon_exit=$ec $(date -Is)"
[ "$ec" -eq 0 ] || exit "$ec"

PROD=out/target/product/sunfish
BID=$(date -u +%Y%m%dT%H%M%SZ)
if [[ -n "${PRODUCT_DEFAULT_DEV_CERTIFICATE:-}" ]]; then
  DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-releasekeys
else
  DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4
fi
mkdir -p "$DEST"

TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
MAKE_BOOT=$PROD/boot.img
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
  cp -v "$TF_BOOT" "$DEST/boot.img"
  cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
  echo "boot_source=target_files_IMAGES"
else
  cp -v "$MAKE_BOOT" "$DEST/boot.img"
  echo "WARN: no TF IMAGES/boot.img — using Make boot"
fi

cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
for f in vbmeta.img dtbo.img; do
  [ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
done

# Module CRC sanity vs kernel (Wi-Fi)
WLAN=$PROD/vendor/lib/modules/wlan.ko
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
  KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
  MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
  echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
  if [ -n "$KCRC" ] && [ -n "$MCRC" ] && [ "$KCRC" = "$MCRC" ]; then
    echo "OK: wlan.ko CRC matches kernel (Wi-Fi pack coherent)"
  else
    echo "WARN: wlan.ko CRC mismatch or unreadable — check before flash"
  fi
fi

MB=out/.magisk/magiskboot
if [ -x "$MB" ]; then
  rm -rf "$DEST/boot-check" && mkdir -p "$DEST/boot-check"
  if ! "$MB" unpack "$DEST/boot.img" "$DEST/boot-check" >/dev/null 2>&1; then
    echo "WARN: magiskboot unpack failed (host SIGILL flake possible)"
  fi
fi
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
  echo "FAIL: KernelSU strings in boot.img" >&2
  exit 1
fi
echo "OK: no KernelSU strings in boot.img"

{
  echo "artifact=$DEST"
  echo "kernel_base=$BASE"
  echo "hardening=Stage1 Graphene/AH + combo4+clang-fortify (nested __underlying_strlen)"
  echo "magisk=preroot EXTENDROM-class v30.7"
  echo "signing=${PRODUCT_DEFAULT_DEV_CERTIFICATE:-test-keys}"
  echo "flash=recovery wipe + sideload zip + reboot system (do NOT flash boot onto other slot alone)"
  date -u +"built=%Y-%m-%dT%H:%M:%SZ"
} | tee "$DEST/README.txt"

(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
  | tee "$DEST/SHA256SUMS"

echo "=== DONE $DEST $(date -Is) ==="