#!/usr/bin/env bash
# Generate project Android + AVB signing keys on rom-dev01 only.
# Never run this to a path inside a Git working tree that gets committed.
set -euo pipefail

OUT="${ANDROID_CERTS_DIR:-}"
if [[ -z "$OUT" ]]; then
  if [[ -d /srv/rom/secrets && -w /srv/rom/secrets ]]; then
    OUT=/srv/rom/secrets/android-certs
  else
    # Lineage convention; /srv/rom/secrets is often root-owned (750, no group write).
    OUT="${HOME}/.android-certs"
  fi
fi
LINEAGE_TOP="${LINEAGE_TOP:-/srv/rom/src/lineage}"
MAKE_KEY="${LINEAGE_TOP}/development/tools/make_key"

# Distinct from AOSP testkey DN (android@android.com).
SUBJECT="${ANDROID_CERT_SUBJECT:-/C=DE/ST=NA/L=NA/O=AXP-Resurection/OU=sunfish-a16/CN=release}"

KEYS=(releasekey platform shared media networkstack sdk_sandbox bluetooth nfc)

if [[ ! -x "$MAKE_KEY" && ! -f "$MAKE_KEY" ]]; then
  echo "ERROR: make_key not found at $MAKE_KEY" >&2
  exit 1
fi

if [[ "$(id -u)" -eq 0 ]]; then
  echo "ERROR: refuse to generate keys as root; run as android-build" >&2
  exit 1
fi

mkdir -p "$OUT"
chmod 700 "$OUT"

existing=0
for k in "${KEYS[@]}"; do
  if [[ -e "$OUT/$k.pk8" || -e "$OUT/$k.x509.pem" ]]; then
    echo "EXISTS: $OUT/$k.*"
    existing=1
  fi
done
if [[ -e "$OUT/avb.pem" ]]; then
  echo "EXISTS: $OUT/avb.pem"
  existing=1
fi
if [[ "$existing" -eq 1 ]]; then
  echo "ERROR: refusing to overwrite. Delete specifically if you truly mean to rotate." >&2
  exit 1
fi

echo "=== Generating APK/OTA keys in $OUT ==="
echo "subject=$SUBJECT"
for k in "${KEYS[@]}"; do
  # make_key always exits 1 because of its EXIT trap — ignore status; check files.
  # Blank password (Lineage/build-server norm); protect via directory mode 700.
  printf '\n' | bash "$MAKE_KEY" "$OUT/$k" "$SUBJECT" || true
  if [[ ! -f "$OUT/$k.pk8" || ! -f "$OUT/$k.x509.pem" ]]; then
    echo "ERROR: failed to create $k" >&2
    exit 1
  fi
  chmod 600 "$OUT/$k.pk8"
  chmod 644 "$OUT/$k.x509.pem"
  echo "OK $k"
done

echo "=== Generating AVB RSA-4096 key ==="
openssl genrsa -out "$OUT/avb.pem" 4096
chmod 600 "$OUT/avb.pem"
# Public key metadata for avbtool / optional custom key flash (not used for lock ship)
if [[ -x "$LINEAGE_TOP/external/avb/avbtool.py" ]]; then
  python3 "$LINEAGE_TOP/external/avb/avbtool.py" extract_public_key \
    --key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
  chmod 644 "$OUT/avb_pkmd.bin"
elif command -v avbtool >/dev/null 2>&1; then
  avbtool extract_public_key --key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
  chmod 644 "$OUT/avb_pkmd.bin"
else
  echo "WARN: avbtool not found; skipped avb_pkmd.bin (openssl key still OK)"
fi

{
  echo "# generated $(date -Is) on $(hostname)"
  echo "subject=$SUBJECT"
  echo "dir=$OUT"
  echo "keys=${KEYS[*]} avb.pem"
} >"$OUT/GENERATED.txt"
chmod 644 "$OUT/GENERATED.txt"

echo
echo "=== DONE ==="
echo "Public releasekey subject:"
openssl x509 -in "$OUT/releasekey.x509.pem" -noout -subject
echo
echo "NEXT (mandatory before first signed ship bacon):"
echo "  1. Encrypted offline backup of $OUT"
echo "  2. If keys are under \$HOME/.android-certs, have root install -d"
echo "     /srv/rom/secrets/android-certs and move/copy there (preferred long-term)."
echo "  3. Record backup location/date in docs/009-hardening-signing-checklist.md"
echo "  4. US-S2: export PRODUCT_DEFAULT_DEV_CERTIFICATE=$OUT/releasekey"
echo "  5. Never copy .pk8 / avb.pem into Git"