#!/usr/bin/env bash
# Assemble the complete RK1 media-center image from locked binary inputs.

set -Eeuo pipefail
umask 022

SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
SSH_PUBLIC_KEY=""
IMAGE_SIZE_MIB=4096
IMAGE_REVISION="r4"
FORCE_REPACK=0

usage() {
  cat <<'EOF'
Usage: ./build.sh --ssh-public-key PATH [--image-size-mib N] [--revision NAME] [--force-repack]

Builds a flashable Turing RK1 image without root, loop devices, or mounts.
The key file may contain one or more plain OpenSSH public keys.
EOF
}

while (($#)); do
  case "$1" in
    --ssh-public-key) SSH_PUBLIC_KEY=${2:?}; shift 2 ;;
    --image-size-mib) IMAGE_SIZE_MIB=${2:?}; shift 2 ;;
    --revision) IMAGE_REVISION=${2:?}; shift 2 ;;
    --force-repack) FORCE_REPACK=1; shift ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown argument: $1" >&2; usage >&2; exit 2 ;;
  esac
done
[[ -n "$SSH_PUBLIC_KEY" ]] || { usage >&2; exit 2; }

"$SCRIPT_DIR/scripts/fetch-inputs.sh"

upstream_deb="$SCRIPT_DIR/downloads/kodi-rockchip-gbm_20260721-1741_trixie_arm64.deb"
media_deb="$SCRIPT_DIR/media/out/rk1-media-stack_20260721.1741+rk1.1_arm64.deb"
if ((FORCE_REPACK)) || [[ ! -s "$media_deb" ]]; then
  "$SCRIPT_DIR/media/scripts/repack-upstream-deb.sh" \
    --deb "$upstream_deb" --output-dir "$SCRIPT_DIR/media/out"
fi
[[ -s "$media_deb.sha256" ]] || { echo "Missing media checksum" >&2; exit 1; }
(
  cd "$(dirname -- "$media_deb")"
  sha256sum --check --status "$(basename -- "$media_deb.sha256")"
) || { echo "Repacked media checksum failed" >&2; exit 1; }

"$SCRIPT_DIR/image/build-image.sh" \
  --ssh-public-key "$SSH_PUBLIC_KEY" \
  --kodi-deb "$media_deb" \
  --image-size-mib "$IMAGE_SIZE_MIB" \
  --revision "$IMAGE_REVISION"