#!/usr/bin/env bash
# Server-only diagnostic build. Uses its own sources/output; never resets LIVE.
# Usage: bash this-script ROOT <family>
# family: see 009-fortify-select-family.py GROUPS
set -euo pipefail
RUN=${1:?isolated root required}
FAMILY=${2:?family required}
case "$FAMILY" in
  full|memory|strings|strings-copy|strings-len|\
  strings-strcpy-strlen|strings-copy-strlen|strings-copy-strnlen|\
  strings-strlen-restcopy|strings-strlen-ncopy|strings-strlen-cat|\
  strings-strlen-strncpy|strings-strlen-strlcpy) ;;
  *) echo "bad family: $FAMILY" >&2; exit 2;;
esac
test -d "$RUN/inputs"
# Subdir name matches family (strings-copy → strings-copy/)
test ! -e "$RUN/$FAMILY"
TOP=/srv/rom/src/lineage
LIVE=$TOP/kernel/google/msm-4.14
PIN=28f9290ae067d3e7857126eb6312720dbe9c7c80
CLANG=$TOP/prebuilts/clang/host/linux-x86/clang-r563880c
BASE=$RUN/$FAMILY
SRC=$BASE/src
OUT=$BASE/out
mkdir -p "$SRC" "$OUT"
git -C "$LIVE" archive "$PIN" | tar -x -C "$SRC"
python3 "$RUN/inputs/apply_fortify_clang.py" "$SRC"
patch -p1 --batch -d "$SRC" < "$RUN/inputs/0001-driver-bounds-rtac-fils.patch"
python3 "$RUN/inputs/009-fortify-select-family.py" "$SRC" "$FAMILY"
cp "$RUN/inputs/failed-full.config" "$OUT/.config"
cp "$OUT/.config" "$BASE/input.config"
export PATH="$TOP/prebuilts/tools-lineage/linux-x86/bin:$TOP/prebuilts/build-tools/linux-x86/bin:$CLANG/bin:$TOP/out/host/linux-x86/bin:/usr/bin:/bin"
export HIP_PATH=none
export PERL5LIB="$TOP/prebuilts/tools-lineage/common/perl-base"
export BISON_PKGDATADIR="$TOP/prebuilts/build-tools/common/bison"
export KBUILD_BUILD_USER=nobody KBUILD_BUILD_HOST=android-build
# An archived patched tree needs the same release suffix as installed modules.
export LOCALVERSION=-g28f9290ae067-dirty
MAKE=("$TOP/prebuilts/build-tools/linux-x86/bin/make" -j8
    "HOSTCFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -I$TOP/prebuilts/kernel-build-tools/linux-x86/include"
    "HOSTLDFLAGS=--sysroot=$TOP/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8/sysroot -Wl,-rpath,$TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -L $TOP/prebuilts/kernel-build-tools/linux-x86/lib64 -fuse-ld=lld --rtlib=compiler-rt"
    LLVM=1 LLVM_IAS=1 "LZ4=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/lz4"
    "LEX=$TOP/prebuilts/build-tools/linux-x86/bin/flex"
    "YACC=$TOP/prebuilts/build-tools/linux-x86/bin/bison"
    "M4=$TOP/prebuilts/build-tools/linux-x86/bin/m4"
    "PAHOLE=$TOP/prebuilts/kernel-build-tools/linux-x86/bin/pahole"
    "LIBCLANG_PATH=$CLANG/lib" "DTC_EXT=$TOP/out/host/linux-x86/bin/dtc"
    -C "$SRC" "O=$OUT" ARCH=arm64 CC=clang LD=ld.lld)
"${MAKE[@]}" olddefconfig
diff -u "$BASE/input.config" "$OUT/.config" > "$BASE/config.diff" || {
    cat "$BASE/config.diff"
    echo 'STOP: unexpected configuration drift' >&2
    exit 3
}
"$CLANG/bin/clang" --version > "$BASE/toolchain.txt"
printf '%s\n' "$PIN" > "$BASE/source-commit.txt"
printf '%q ' "${MAKE[@]}" > "$BASE/make-command.txt"
"${MAKE[@]}" Image.lz4 modules
cp "$OUT/.config" "$BASE/final.config"
test "$(cat "$OUT/include/config/kernel.release")" = '4.14.357-openela-g28f9290ae067-dirty'
if "$CLANG/bin/llvm-nm" "$OUT/vmlinux" | grep -Eq ' [Tt] __((read_overflow[23]?)|(write_overflow))$'; then
    echo 'STOP: forbidden overflow stubs' >&2
    exit 4
fi
mkdir "$BASE/pack"
cd "$BASE/pack"
MB=$(find /srv/rom/prebuilts/magisk -type f -name magiskboot -print -quit)
test -n "$MB"
GOOD=/srv/rom/artifacts/009-axp-los23-port/20260918T143547Z-axp-full/boot-make.img
"$MB" unpack "$GOOD" > "$BASE/good-header.txt" 2>&1
sha256sum ramdisk.cpio > "$BASE/ramdisk.sha256"
cp "$OUT/arch/arm64/boot/Image" kernel
"$MB" repack "$GOOD" "$BASE/boot-make.img"
sha256sum "$BASE/boot-make.img" "$OUT/arch/arm64/boot/Image" "$OUT/vmlinux" > "$BASE/SHA256SUMS"
printf 'DIAGNOSTIC ONLY: %s family; not full FORTIFY. Requires local unpack/header/kernel verification before LAB use.\n' "$FAMILY" > "$BASE/README.txt"
echo "BUILD COMPLETE: $BASE/boot-make.img"