#!/bin/bash
# 009 bacon — ship pack with project release keys (US-S2).
# Stage1+combo4+FORTIFY + CVE clean + hi-batch1+2+3 + PRODUCT_DEFAULT_DEV_CERTIFICATE.
# Requires $HOME/.android-certs/releasekey.{pk8,x509.pem}. userdebug.
set -e
cd /srv/rom/src/lineage
export HOME=/home/android-build
export CCACHE_DIR=/srv/rom/ccache
export USE_CCACHE=1
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
unset OUT_DIR || true
export SUNFISH_A16_MAGISK_PREROOT=1
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk

LOGDIR=/srv/rom/logs/009-build
mkdir -p "$LOGDIR"
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-releasekeys.log
exec > >(tee -a "$LOG") 2>&1

echo "=== START 009-bacon-axp-cve-hi-releasekeys $(date -Is) ==="

CERT_DIR="${ANDROID_CERTS_DIR:-$HOME/.android-certs}"
if [[ ! -f "$CERT_DIR/releasekey.pk8" || ! -f "$CERT_DIR/releasekey.x509.pem" ]]; then
  echo "FAIL: missing $CERT_DIR/releasekey.{pk8,x509.pem}" >&2
  exit 1
fi
export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
echo "OK: PRODUCT_DEFAULT_DEV_CERTIFICATE=$PRODUCT_DEFAULT_DEV_CERTIFICATE"

LIVE=kernel/google/msm-4.14
BASE=28f9290ae067
KH=vendor/sunfish-a16/patches/009-kernel-hardening
LIST_CLEAN="$KH/cve-clean-offset.list"
LIST_HI1="$KH/cve-high-offset-batch1.list"
LIST_HI2="$KH/cve-high-offset-batch2.list"
LIST_HI3="$KH/cve-high-offset-batch3.list"
test -f "$LIST_CLEAN"
test -f "$LIST_HI1"
test -f "$LIST_HI2"
test -f "$LIST_HI3"
test -d "$LIVE"

echo "=== reset kernel @ $BASE ==="
git -C "$LIVE" reset --hard "$BASE"
git -C "$LIVE" clean -fdq

chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
  "$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true

bash "$KH/apply_stage1_combo4.sh" "$LIVE"

# US-S5-1 — Yama + SLAB_FREELIST_RANDOM (Graphene/AXP defconfig gaps)
chmod +x "$KH/apply_uss5_1_defconfig.sh" 2>/dev/null || true
bash "$KH/apply_uss5_1_defconfig.sh" "$LIVE"

export CVE_STRICT_LIST="$LIST_CLEAN"
unset CVE_STRICT_CONTINUE || true
export CVE_MAX_FUZZ=1
export CVE_MAX_ABS_OFFSET=200
bash "$KH/apply_cve_strict.sh" "$LIVE"

export CVE_MAX_ABS_OFFSET=9999
for L in "$LIST_HI1" "$LIST_HI2" "$LIST_HI3"; do
  echo "=== high-offset $(basename "$L") ==="
  export CVE_STRICT_LIST="$L"
  bash "$KH/apply_cve_strict.sh" "$LIVE"
done

DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
  echo "FAIL: KernelSU in defconfig" >&2
  exit 1
fi
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
         SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED \
         SECURITY_YAMA SLAB_FREELIST_RANDOM; do
  grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
done
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 markers present"

rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
      out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
      out/target/product/sunfish/kernel

python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_unofficial_build_id.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_openssh_packages.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_jelly_gallery2.py

# Host prebuilts → vendor/sunfish-a16/prebuilt (rsync --delete must not wipe these).
mkdir -p vendor/sunfish-a16/prebuilt
link_prebuilt() {
  local name="$1" src="$2"
  local dst="vendor/sunfish-a16/prebuilt/$name"
  ln -sfn "$src" "$dst"
  test -e "$dst" || { echo "FAIL: missing prebuilt $dst -> $src" >&2; exit 1; }
}
link_prebuilt Phonesky.apk /srv/rom/prebuilts/phonesky/Phonesky.apk
link_prebuilt GmsCore.apk /srv/rom/prebuilts/microg/GmsCore.apk
link_prebuilt GsfProxy.apk /srv/rom/prebuilts/microg/GsfProxy.apk
link_prebuilt AuroraStore.apk /srv/rom/prebuilts/axp-apps/AuroraStore.apk
link_prebuilt Droidify.apk /srv/rom/prebuilts/axp-apps/Droidify.apk
link_prebuilt FossifyGallery.apk /srv/rom/prebuilts/axp-apps/FossifyGallery.apk
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
"$AAPT" dump permissions vendor/sunfish-a16/prebuilt/Phonesky.apk 2>/dev/null | grep -q USE_EXACT_ALARM

# Early hook so LINEAGE_VERSION includes AXP-Resurection-Pro (before version.mk).
mkdir -p vendor/extra
ln -sfn ../sunfish-a16/extra-product.mk vendor/extra/product.mk
test -f vendor/extra/product.mk

MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
  vendor/sunfish-a16/magisk/prepare_magisk.sh
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
test -f out/.magisk/READY

rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
rm -f out/target/product/sunfish/lineage-*.zip \
      out/target/product/sunfish/boot.img \
      out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java

set +u
# shellcheck disable=SC1091
source build/envsetup.sh
set -e
# re-export after envsetup (some trees clear it)
export PRODUCT_DEFAULT_DEV_CERTIFICATE="$CERT_DIR/releasekey"
breakfast sunfish userdebug
test "${TARGET_RELEASE:-}" = "bp4a"
BT_SEPOL=$(get_build_var MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES)
echo "MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES=$BT_SEPOL"
case "$BT_SEPOL" in
  *vendor/sunfish-a16/certs*) ;;
  *) echo "FAIL: BT sepolicy certs still AOSP default ($BT_SEPOL)" >&2; exit 1 ;;
esac
AVB_KEY=$(get_build_var BOARD_AVB_KEY_PATH)
AVB_ALG=$(get_build_var BOARD_AVB_ALGORITHM)
echo "BOARD_AVB_KEY_PATH=$AVB_KEY"
echo "BOARD_AVB_ALGORITHM=$AVB_ALG"
case "$AVB_KEY" in
  *vendor/sunfish-a16/certs/avb.pem) ;;
  *) echo "FAIL: AVB key not project certs/avb.pem ($AVB_KEY)" >&2; exit 1 ;;
esac
[[ "$AVB_ALG" == "SHA256_RSA4096" ]] || { echo "FAIL: AVB alg=$AVB_ALG" >&2; exit 1; }

echo "=== mka bacon $(date -Is) signing=$PRODUCT_DEFAULT_DEV_CERTIFICATE ==="
set -o pipefail
mka bacon -j8
ec=${PIPESTATUS[0]}
echo "bacon_exit=$ec $(date -Is)"
[ "$ec" -eq 0 ] || exit "$ec"

# Post-ship gates: drop pipefail. Early-exit awk/head + large pipes otherwise
# yield exit=141 (SIGPIPE) and skip Magisk/AVB/US-S4 checks.
set +o pipefail

PROD=out/target/product/sunfish
BID=$(date -u +%Y%m%dT%H%M%SZ)
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-releasekeys
mkdir -p "$DEST"

# Ship pair = target_files IMAGES (Magisk boot + matching vbmeta). OUT/*.img can be
# stock make images that do NOT match the OTA payload — do not prefer those.
TF_IMG=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -type d -path '*/IMAGES' 2>/dev/null | head -1)
[[ -n "${TF_IMG:-}" && -d "$TF_IMG" ]] || { echo "FAIL: missing target_files IMAGES" >&2; exit 1; }
TF_IMG=$(readlink -f "$TF_IMG")
for f in boot.img vbmeta.img vbmeta_system.img dtbo.img; do
  [[ -f "$TF_IMG/$f" ]] || { echo "FAIL: missing $TF_IMG/$f" >&2; exit 1; }
  cp -v "$TF_IMG/$f" "$DEST/"
done
# Large partition images: hardlink into DEST so verify_image stays repeatable
# after OUT is cleaned (same FS). Fallback: absolute symlink, then full copy.
for f in vendor.img product.img system.img system_ext.img; do
  [[ -f "$TF_IMG/$f" ]] || continue
  rm -f "$DEST/$f"
  if cp -al "$TF_IMG/$f" "$DEST/$f" 2>/dev/null; then
    echo "hardlink $f -> $DEST/$f"
  elif ln -sfn "$TF_IMG/$f" "$DEST/$f"; then
    echo "symlink-abs $f -> $TF_IMG/$f"
  else
    cp -v "$TF_IMG/$f" "$DEST/$f"
  fi
done
# Keep make OUT boot for forensics only (often stock / non-Magisk).
cp -v "$PROD/boot.img" "$DEST/boot-make-out.img" 2>/dev/null || true
cp -v "$PROD"/lineage-*-UNOFFICIAL*.zip "$DEST/" 2>/dev/null || \
  cp -v "$PROD"/lineage-*.zip "$DEST/" 2>/dev/null || true

# Publish AXP Resurection Pro ship name (hardlink/copy). Lineage bacon.mk still
# emits lineage-*.zip; do not rebuild solely to rename.
ZIP_LINEAGE=$(ls "$DEST"/lineage-*.zip 2>/dev/null | head -1 || true)
if [[ -n "${ZIP_LINEAGE:-}" ]]; then
  # lineage-23.2-YYYYMMDD-UNOFFICIAL[-AXP-Resurection[-Pro]]-sunfish.zip
  # → AXP-Resurection-Pro-23.2-YYYYMMDD-sunfish.zip
  ZIP_BASE=$(basename "$ZIP_LINEAGE")
  ZIP_AXP=$(echo "$ZIP_BASE" | sed -E \
    's/^lineage-([0-9]+\.[0-9]+)-([0-9]{8})(-[0-9]{6})?-UNOFFICIAL(-AXP-Resurection(-Pro)?)?-sunfish\.zip$/AXP-Resurection-Pro-\1-\2\3-sunfish.zip/')
  if [[ "$ZIP_AXP" == "$ZIP_BASE" ]]; then
    ZIP_AXP="AXP-Resurection-Pro-${ZIP_BASE#lineage-}"
  fi
  ln -f "$ZIP_LINEAGE" "$DEST/$ZIP_AXP" 2>/dev/null || cp -v "$ZIP_LINEAGE" "$DEST/$ZIP_AXP"
  echo "ship_zip=$ZIP_AXP (from $ZIP_BASE)"
fi

WLAN=$PROD/vendor/lib/modules/wlan.ko
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
  KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
  MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
  echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
fi

# Avoid pipefail SIGPIPE: never `strings | grep` on large boot.img.
_BOOT_STR=$(mktemp)
strings "$DEST/boot.img" >"$_BOOT_STR"
if grep -iE 'KernelSU|CONFIG_KSU_SUSFS' "$_BOOT_STR" >/dev/null; then
  rm -f "$_BOOT_STR"
  echo "FAIL: KernelSU in boot" >&2
  exit 1
fi
rm -f "$_BOOT_STR"

# Magisk preroot must be present on the ship boot (magiskboot cpio test: 0=stock, 1=Magisk).
MAGISKBOOT="$ANDROID_BUILD_TOP/out/.magisk/magiskboot"
[[ -x "$MAGISKBOOT" ]] || { echo "FAIL: missing $MAGISKBOOT" >&2; exit 1; }
MB_TMP=$(mktemp -d)
cp "$DEST/boot.img" "$MB_TMP/boot.img"
set +e
( cd "$MB_TMP" && "$MAGISKBOOT" unpack boot.img >/dev/null )
( cd "$MB_TMP" && "$MAGISKBOOT" cpio ramdisk.cpio test )
MB_EC=$?
set -e
rm -rf "$MB_TMP"
# magiskboot cpio test: 0=stock, non-zero (usually 1) = Magisk present
[[ "$MB_EC" -ne 0 ]] || { echo "FAIL: ship boot is stock (magiskboot cpio test=$MB_EC); expected Magisk" >&2; exit 1; }
echo "magiskboot_cpio_test=$MB_EC (non-zero => Magisk present)"

ZIP=$(ls "$DEST"/lineage-*-UNOFFICIAL*.zip 2>/dev/null | head -1 || true)
if [[ -n "$ZIP" ]]; then
  unzip -p "$ZIP" META-INF/com/android/otacert 2>/dev/null | openssl x509 -noout -subject 2>/dev/null \
    | tee "$DEST/otacert-subject.txt" || true
  if grep -qi 'Test Keys\|Android\|AOSP' "$DEST/otacert-subject.txt" 2>/dev/null; then
    echo "WARN: otacert subject looks like test/AOSP — check keys wire" | tee -a "$DEST/README.txt"
  fi
fi

# US-S3 artifact gates — fail closed (signing infrastructure; NOT runtime AVB harden).
# flags=3 => HASHTREE_DISABLED|VERIFICATION_DISABLED (libavb); Magisk-friendly unlocked LAB.
AVBTOOL="$ANDROID_BUILD_TOP/out/host/linux-x86/bin/avbtool"
AVB_PEM="$ANDROID_BUILD_TOP/vendor/sunfish-a16/certs/avb.pem"
AVB_PKMD="$ANDROID_BUILD_TOP/vendor/sunfish-a16/certs/avb_pkmd.bin"
[[ -x "$AVBTOOL" ]] || { echo "FAIL: missing $AVBTOOL" >&2; exit 1; }
[[ -f "$DEST/vbmeta.img" ]] || { echo "FAIL: missing $DEST/vbmeta.img" >&2; exit 1; }
[[ -f "$DEST/boot.img" ]] || { echo "FAIL: missing $DEST/boot.img" >&2; exit 1; }
[[ -f "$AVB_PEM" ]] || { echo "FAIL: missing $AVB_PEM" >&2; exit 1; }
if [[ ! -f "$AVB_PKMD" ]]; then
  "$AVBTOOL" extract_public_key --key "$AVB_PEM" --output "$AVB_PKMD"
fi

"$AVBTOOL" info_image --image "$DEST/vbmeta.img" | tee "$DEST/vbmeta-info.txt"
EXP=$(sha1sum "$AVB_PKMD" | awk '{print $1}')
GOT=$(awk '/^Public key \(sha1\):/{print $NF; exit}' "$DEST/vbmeta-info.txt")
FLAGS=$(awk '/^Flags:/{print $2; exit}' "$DEST/vbmeta-info.txt")
echo "avb_pubkey_sha1 artifact=$GOT project=$EXP flags=$FLAGS"
[[ -n "$GOT" ]] || { echo "FAIL: could not parse vbmeta public key sha1" >&2; exit 1; }
[[ "$GOT" == "$EXP" ]] || { echo "FAIL: vbmeta pubkey != project avb_pkmd.bin" >&2; exit 1; }
[[ "$FLAGS" == "3" ]] || { echo "FAIL: expected vbmeta Flags 3 (Magisk track), got '$FLAGS'" >&2; exit 1; }

# Cryptographic check against TF sibling images in $DEST (hardlinked/copied).
# Magisk boot footer is Algorithm NONE — chain trust is top-level vbmeta + project key.
# Does NOT mean the device will enforce AVB at boot (flags 3 disables that).
set +e
(
  cd "$DEST"
  "$AVBTOOL" verify_image --image vbmeta.img --key "$AVB_PEM" \
    --expected_chain_partition "vbmeta_system:1:$AVB_PKMD"
) >"$DEST/vbmeta-verify.txt" 2>&1
ec_v=$?
set -e
cat "$DEST/vbmeta-verify.txt"
[[ "$ec_v" -eq 0 ]] || { echo "FAIL: avbtool verify_image vbmeta.img (TF Magisk boot chain)" >&2; exit 1; }

set +e
(
  cd "$DEST"
  "$AVBTOOL" verify_image --image vbmeta_system.img --key "$AVB_PEM"
) >"$DEST/vbmeta_system-verify.txt" 2>&1
ec_s=$?
set -e
cat "$DEST/vbmeta_system-verify.txt"
[[ "$ec_s" -eq 0 ]] || { echo "FAIL: avbtool verify_image vbmeta_system.img" >&2; exit 1; }

# Boot footer integrity (unsigned Magisk footer is OK); do not require --key match.
set +e
(
  cd "$DEST"
  "$AVBTOOL" verify_image --image boot.img
) >"$DEST/boot-verify.txt" 2>&1
ec_b=$?
set -e
cat "$DEST/boot-verify.txt"
[[ "$ec_b" -eq 0 ]] || { echo "FAIL: avbtool verify_image boot.img footer/hash" >&2; exit 1; }

# US-S4-1 — AXP PRO product surface (binaries gone; init.openssh.rc kept).
SIMG="$ANDROID_BUILD_TOP/out/host/linux-x86/bin/simg2img"
[[ -x "$SIMG" ]] || { echo "FAIL: missing $SIMG" >&2; exit 1; }
[[ -e "$DEST/product.img" ]] || { echo "FAIL: missing $DEST/product.img" >&2; exit 1; }
PROD_RAW=$(mktemp /tmp/axp-product-XXXX.img)
"$SIMG" "$DEST/product.img" "$PROD_RAW"
for p in /bin/sshd /bin/ssh /bin/scp /bin/sftp /bin/rsync /bin/start-ssh; do
  if debugfs -R "stat $p" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
    rm -f "$PROD_RAW"
    echo "FAIL: US-S4 expected absent $p on product.img" >&2
    exit 1
  fi
done
if ! debugfs -R "stat /etc/init/init.openssh.rc" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
  rm -f "$PROD_RAW"
  echo "FAIL: US-S4 expected init.openssh.rc present (AXP surface)" >&2
  exit 1
fi
echo "US-S4-1 product surface OK (no ssh/rsync bins; init.openssh.rc present)"

# US-S4-2 — AXP PRO: no Jelly / Gallery2 *apps* on product (Fossify stays).
# Note: LOCAL_OVERRIDES removes Gallery2.apk but stale JNI symlink dirs under
# product/app/Gallery2/lib can remain from older out/ — gate on the APK.
for p in /app/Jelly/Jelly.apk /app/Gallery2/Gallery2.apk; do
  if debugfs -R "stat $p" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
    rm -f "$PROD_RAW"
    echo "FAIL: US-S4-2 expected absent $p on product.img" >&2
    exit 1
  fi
done
# Directory-only Gallery2 leftover (jni symlinks) is not a shipped app — warn.
if debugfs -R "stat /app/Gallery2" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
  echo "WARN: US-S4-2 /app/Gallery2 dir still present (likely stale jni symlinks; no APK)"
fi
if ! debugfs -R "stat /app/FossifyGallery" "$PROD_RAW" 2>&1 | grep -q 'Inode:'; then
  rm -f "$PROD_RAW"
  echo "FAIL: US-S4-2 expected FossifyGallery present" >&2
  exit 1
fi
rm -f "$PROD_RAW"
echo "US-S4-2 product surface OK (no Jelly/Gallery2 APK; FossifyGallery present)"

{
  echo "artifact=$DEST"
  echo "list_clean=$LIST_CLEAN (429)"
  echo "list_hi=batch1+2+3"
  echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 + US-S4-1-no-openssh + US-S4-2-no-jelly-gallery2 + US-S5-1-yama-slabrand"
  echo "branding=AXP-Resurection-Pro"
  echo "signing=$PRODUCT_DEFAULT_DEV_CERTIFICATE"
  echo "avb_infra=$AVB_KEY alg=$AVB_ALG flags=3 (HASHTREE_DISABLED|VERIFICATION_DISABLED)"
  echo "avb_runtime_enforce=no (unlocked Magisk track; not AVB-hardened boot)"
  echo "avb_pubkey_sha1=$GOT"
  echo "magiskboot_cpio_test=$MB_EC"
  echo "ship_images=target_files/IMAGES (not OUT make images)"
  echo "ship_zip_brand=AXP-Resurection-Pro-*-sunfish.zip (sibling of lineage-*.zip; not slim)"
  echo "flash=sideload AXP-Resurection-Pro zip (or lineage twin); boot-only insufficient"
  echo "recover=20261002T085915Z-axp-stage1-combo4-cve-hi-releasekeys"
  echo "bootloader_lock=wont"
  echo "oem_unlock=leave_enabled_escape_hatch_not_guaranteed_recovery"
  date -u +"built=%Y-%m-%dT%H:%M:%SZ"
} | tee "$DEST/README.txt"

(cd "$DEST" && sha256sum boot.img boot-make-out.img vbmeta.img vbmeta_system.img dtbo.img \
  lineage-*.zip AXP-Resurection-Pro-*.zip 2>/dev/null || true) \
  | tee "$DEST/SHA256SUMS"

echo "FLASH_READY $DEST"
echo "=== DONE $DEST $(date -Is) ==="
exit 0