#!/usr/bin/env bash

# This script is used to publish new RPM packages to the CLI RPM repository
# Usage: ./publish-rpm-packages.sh
set -eo pipefail

PACKAGES_BUCKET_URL="https://packages.stackit.cloud"
PUBLIC_KEY_FILE_PATH="keys/key.gpg"
RPM_REPO_PATH="rpm/cli"
RPM_BUCKET_NAME="distribution"
GORELEASER_PACKAGES_FOLDER="dist/"

# We need to disable the key database daemon (keyboxd)
# This can be done by removing "use-keyboxd" from ~/.gnupg/common.conf (see https://github.com/gpg/gnupg/blob/master/README)
echo -n >~/.gnupg/common.conf

# Create RPM repository directory structure
printf ">>> Creating RPM repository structure \n"
mkdir -p rpm-repo/x86_64
mkdir -p rpm-repo/i386
mkdir -p rpm-repo/aarch64

# Copy RPM packages to appropriate architecture directories
printf "\n>>> Copying RPM packages to architecture directories \n"

# Copy x86_64 packages (amd64)
for rpm_file in "${GORELEASER_PACKAGES_FOLDER}"*_amd64.rpm; do
    if [ -f "$rpm_file" ]; then
        cp "$rpm_file" rpm-repo/x86_64/
        printf "Copied %s to x86_64/\n" "$(basename "$rpm_file")"
    fi
done

# Copy i386 packages
for rpm_file in "${GORELEASER_PACKAGES_FOLDER}"*_386.rpm; do
    if [ -f "$rpm_file" ]; then
        cp "$rpm_file" rpm-repo/i386/
        printf "Copied %s to i386/\n" "$(basename "$rpm_file")"
    fi
done

# Copy aarch64 packages (arm64)
for rpm_file in "${GORELEASER_PACKAGES_FOLDER}"*_arm64.rpm; do
    if [ -f "$rpm_file" ]; then
        cp "$rpm_file" rpm-repo/aarch64/
        printf "Copied %s to aarch64/\n" "$(basename "$rpm_file")"
    fi
done

# Download existing repository content (RPMs and metadata) if it exists
printf "\n>>> Downloading existing repository content \n"
aws s3 sync s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ rpm-repo/ --endpoint-url "${AWS_ENDPOINT_URL}" --exclude "*.asc" || echo "No existing repository found, creating new one"

# Create repository metadata for each architecture
printf "\n>>> Creating repository metadata \n"
for arch in x86_64 i386 aarch64; do
    if [ -d "rpm-repo/${arch}" ] && [ -n "$(find "rpm-repo/${arch}" -mindepth 1 -maxdepth 1 -print -quit)" ]; then
        printf "Creating metadata for %s...\n" "$arch"
        
        # List what we're working with
        file_list=$(find "rpm-repo/${arch}" -maxdepth 1 -type f -exec basename {} \; | tr '\n' ' ')
        printf "Files in %s: %s\n" "$arch" "${file_list% }"
        
        # Create repository metadata
        createrepo_c --update rpm-repo/${arch}
        
        # Sign the repository metadata
        printf "Signing repository metadata for %s...\n" "$arch"
        # Remove existing signature file if it exists
        rm -f rpm-repo/${arch}/repodata/repomd.xml.asc
        gpg --batch --pinentry-mode loopback --detach-sign --armor \
            --local-user "${GPG_PRIVATE_KEY_FINGERPRINT}" \
            --passphrase "${GPG_PASSPHRASE}" \
            rpm-repo/${arch}/repodata/repomd.xml
        
        # Verify the signature was created
        if [ -f "rpm-repo/${arch}/repodata/repomd.xml.asc" ]; then
            printf "Repository metadata signed successfully for %s\n" "$arch"
        else
            printf "WARNING: Repository metadata signature not created for %s\n" "$arch"
        fi
    else
        printf "No packages found for %s, skipping...\n" "$arch"
    fi
done

# Upload the updated repository to S3 in two phases (repodata pointers last)
# clients reading the repo won't see a state where repomd.xml points to files not uploaded yet.
printf "\n>>> Uploading repository to S3 (phase 1: all except repomd*) \n"
aws s3 sync rpm-repo/ s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ \
  --endpoint-url "${AWS_ENDPOINT_URL}" \
  --delete \
  --exclude "*/repodata/repomd.xml" \
  --exclude "*/repodata/repomd.xml.asc"

printf "\n>>> Uploading repository to S3 (phase 2: repomd* only) \n"
aws s3 sync rpm-repo/ s3://${RPM_BUCKET_NAME}/${RPM_REPO_PATH}/ \
  --endpoint-url "${AWS_ENDPOINT_URL}" \
  --exclude "*" \
  --include "*/repodata/repomd.xml" \
  --include "*/repodata/repomd.xml.asc"

# Upload the public key
# Also uploaded in APT publish; intentionally redundant
# Safe to overwrite and ensures updates if APT fails or key changes.
printf "\n>>> Uploading public key \n"
gpg --armor --export "${GPG_PRIVATE_KEY_FINGERPRINT}" > public-key.asc
aws s3 cp public-key.asc s3://${RPM_BUCKET_NAME}/${PUBLIC_KEY_FILE_PATH} --endpoint-url "${AWS_ENDPOINT_URL}"

printf "\n>>> RPM repository published successfully! \n"
printf "Repository URL: %s/%s/ \n" "$PACKAGES_BUCKET_URL" "$RPM_REPO_PATH"
printf "Public key URL: %s/%s \n" "$PACKAGES_BUCKET_URL" "$PUBLIC_KEY_FILE_PATH"
