#!/bin/sh
# Build the rsh SSH transport for each Android ABI as a Bionic PIE executable
# named lib*.so (packaged inside the APK and exec'd from nativeLibraryDir),
# using the Android NDK. Also build a plain host binary for tests and manual
# debugging.
#
# Android needs PIE and the Bionic dynamic linker (/system/bin/linker64), so
# the on-device build is GOOS=android with cgo and the NDK clang. A GOOS=linux
# build targets glibc's linker and will not exec on a phone.
set -eu

root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
# shellcheck source=versions
. "$root/versions"

command -v bash >/dev/null 2>&1 || {
	echo "rsh: bash is required by the Android NDK compiler launchers" >&2
	exit 1
}

# Locate the NDK toolchain.
ndk=${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}
if [ -z "$ndk" ] && [ -n "${ANDROID_HOME:-}" ]; then
	ndk="$ANDROID_HOME/ndk/$ANDROID_NDK"
fi
if [ -z "$ndk" ] || [ ! -d "$ndk" ]; then
	echo "rsh: Android NDK not found; set ANDROID_NDK_HOME" >&2
	exit 1
fi
# NDK prebuilt toolchains are named by build host, not target. Pick the tag
# matching this machine (macOS ships an x86_64 clang that runs under Rosetta on
# Apple Silicon); the target ABI is selected separately below.
case "$(uname -s)" in
Linux)  host_tag=linux-x86_64 ;;
Darwin) host_tag=darwin-x86_64 ;;
*)      echo "rsh: unsupported build host $(uname -s)" >&2; exit 1 ;;
esac
tc="$ndk/toolchains/llvm/prebuilt/$host_tag/bin"
if [ ! -d "$tc" ]; then
	echo "rsh: NDK toolchain not found at $tc" >&2
	exit 1
fi
output=
trap 'if [ -n "$output" ]; then rm -f "$output"; fi' 0 1 2 3 15

# -buildvcs=false as well as -trimpath: Go otherwise stamps the commit, the
# commit time and a dirty flag into the binary, so the same source builds
# differently depending on the checkout it was built from, or on whether git is
# even installed. ci/verify-repro.sh cannot catch that, because it builds twice
# from one tree.
ldflags="-s -w -buildid="
# NDK r27 needs both page-size flags for 16 KB Android devices.
android_ldflags="$ldflags -extldflags=-Wl,-z,relro,-z,now,-z,noexecstack,-z,max-page-size=16384,-z,common-page-size=16384"

cd "$root/rsh"

for abi in $ABIS; do
	case "$abi" in
	arm64-v8a)   goarch=arm64 goarm='' cc="aarch64-linux-android${ANDROID_MIN_SDK}-clang" ;;
	armeabi-v7a) goarch=arm   goarm=7 cc="armv7a-linux-androideabi${ANDROID_MIN_SDK}-clang" ;;
	x86_64)      goarch=amd64 goarm='' cc="x86_64-linux-android${ANDROID_MIN_SDK}-clang" ;;
	x86)         goarch=386   goarm='' cc="i686-linux-android${ANDROID_MIN_SDK}-clang" ;;
	*) echo "rsh: unknown ABI $abi" >&2; exit 1 ;;
	esac
	dest="$root/app/src/main/jniLibs/$abi"
	mkdir -p "$dest"
	echo "rsh: building $abi (android/$goarch)"
	output="$dest/libxrsh.so.part.$$"
	CGO_ENABLED=1 GOOS=android GOARCH="$goarch" GOARM="$goarm" \
		CC="$tc/$cc" GOFLAGS=-trimpath \
		CGO_CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -ffile-prefix-map=$root=." \
		go build -buildvcs=false -buildmode=pie -ldflags "$android_ldflags" -o "$output" .
	mv "$output" "$dest/libxrsh.so"
	output=
done

# Host binary (no NDK, cgo off) for tests and manual debugging.
mkdir -p "$root/out"
echo "rsh: building host binary -> out/rsh"
output="$root/out/rsh.part.$$"
CGO_ENABLED=0 GOFLAGS=-trimpath go build -buildvcs=false -ldflags "$ldflags" -o "$output" .
mv "$output" "$root/out/rsh"
output=