#!/bin/bash
# Build reauktion-home-ca_<ver>_all.deb from this directory using dpkg-deb
# directly. Run from inside the runner container, which has dpkg installed.
#
# No upstream tarball: this is PKI trust material (the reauktion.de Home CA
# root cert), not software with its own release cadence. The .crt is
# committed alongside this script instead of being fetched.
set -euo pipefail

PKGVER=20260716
PKGREL=1
HERE=$(dirname "$(readlink -f "$0")")

# Reproducible build: pin all file mtimes + ar member timestamps so repeat
# builds produce identical bytes (reprepro refuses re-includes otherwise).
export SOURCE_DATE_EPOCH=1784505600

work=$(mktemp -d)
trap "rm -rf $work" EXIT

ROOT="$work/pkgroot"
mkdir -p "$ROOT/DEBIAN" \
         "$ROOT/usr/local/share/ca-certificates" \
         "$ROOT/usr/share/doc/reauktion-home-ca"

install -m 644 "$HERE/reauktion-home-ca.crt" \
    "$ROOT/usr/local/share/ca-certificates/reauktion-home-ca.crt"

cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/reauktion-home-ca/copyright"
cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
gzip -9 -n "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"

install -m 755 "$HERE/debian/postinst" "$ROOT/DEBIAN/postinst"
install -m 755 "$HERE/debian/postrm"   "$ROOT/DEBIAN/postrm"

cat > "$ROOT/DEBIAN/control" <<EOF
Package: reauktion-home-ca
Version: ${PKGVER}-${PKGREL}
Section: admin
Priority: optional
Architecture: all
Depends: ca-certificates
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
Homepage: https://git.reauktion.de/marfrit/marfrit-packages
Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
 Installs the private, name-constrained root CA used to sign internal
 *.fritz.box and reauktion.de HTTPS services, so clients don't need -k
 or browser exceptions to reach them.
 .
 Name constraints permit only fritz.box, reauktion.de, and localhost —
 a leaked key can forge certificates for no other domain.
 .
 SHA256 fingerprint:
 A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
EOF

# Build the .deb. Output to current dir of the caller.
DEB_OUT=reauktion-home-ca_${PKGVER}-${PKGREL}_all.deb
dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
echo "built: $HERE/$DEB_OUT"