#!/bin/sh
# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
# make-libqcomtee.sh — build libqcomtee for a target, without QCBOR.
#
#   packaging/make-libqcomtee.sh [--target=<triple> --sysroot=<dir>] [outdir]
#
# libqcomtee is Qualcomm's BSD-3 userspace client for QTEE (quic/quic-teec).
# Upstream's CMake does find_package(QCBOR REQUIRED) and falls back to libcbor,
# but that dependency exists for exactly one file, src/objects/credentials_obj.c,
# which builds the {AttrUid, AttrSystemTime} CBOR map.
#
# fingerprintd builds that map itself in Fingerprintd:Tee, where it is thirteen
# bytes under test rather than a library dependency, and implements the
# credentials object's two-op read protocol in its own shell. So only two of
# the three sources are needed:
#
#   src/qcomtee_object.c     the object/marshalling core
#   src/objects/mem_obj.c    memory objects (CAPTURE_IMAGE needs a real region)
#
# Nothing in either references credentials_obj, so dropping it leaves the
# library with no dependency beyond libc.
set -eu

REPO="${QUIC_TEEC_REPO:-https://github.com/quic/quic-teec.git}"
# Pinned. Upstream is small and moves rarely; an unpinned clone would change
# the marshalling under us without notice.
COMMIT="${QUIC_TEEC_COMMIT:-736419e}"
SRC="${QUIC_TEEC_DIR:-$HOME/.cache/fingerprintd/quic-teec}"

TARGET=""
SYSROOT=""
MARCH=""
OUT=""
for a in "$@"; do
    case "$a" in
        --target=*)  TARGET="${a#--target=}" ;;
        --sysroot=*) SYSROOT="${a#--sysroot=}" ;;
        --march=*)   MARCH="${a#--march=}" ;;
        -*)          echo "unknown option: $a" >&2; exit 1 ;;
        *)           OUT="$a" ;;
    esac
done
[ -n "$OUT" ] || OUT="$HOME/.cache/fingerprintd/libqcomtee${TARGET:+-$TARGET}"

if [ ! -d "$SRC/.git" ]; then
    echo ">> cloning $REPO -> $SRC"
    mkdir -p "$(dirname "$SRC")"
    git clone -q "$REPO" "$SRC"
    git -C "$SRC" checkout -q "$COMMIT"
elif [ -n "${QUIC_TEEC_DIR:-}" ]; then
    # A checkout the caller pointed us at is THEIRS. Never move its HEAD --
    # silently checking out a pin in someone's working tree is how you lose
    # uncommitted work. Report the mismatch and let them decide.
    have=$(git -C "$SRC" rev-parse --short HEAD)
    case "$COMMIT" in
        "$have"*) : ;;
        *) echo "!! $SRC is at $have, not the pinned $COMMIT." >&2
           echo "!! Building from it anyway; unset QUIC_TEEC_DIR to use a pinned clone." >&2 ;;
    esac
else
    git -C "$SRC" fetch -q --all 2>/dev/null || true
    git -C "$SRC" checkout -q "$COMMIT"
fi

mkdir -p "$OUT"
set -- -O2 -Wall -fPIC
[ -n "$TARGET" ]  && set -- "$@" --target="$TARGET"
[ -n "$SYSROOT" ] && set -- "$@" --sysroot="$SYSROOT"
[ -n "$MARCH" ]   && set -- "$@" -march="$MARCH"

echo ">> building libqcomtee.a (no QCBOR) for ${TARGET:-native}"
for f in src/qcomtee_object.c src/objects/mem_obj.c; do
    clang "$@" -I"$SRC/libqcomtee/include" -I"$SRC/libqcomtee/src" \
        -c "$SRC/libqcomtee/$f" -o "$OUT/$(basename "$f" .c).o"
done
rm -f "$OUT/libqcomtee.a"
llvm-ar rcs "$OUT/libqcomtee.a" "$OUT"/*.o
mkdir -p "$OUT/include"
cp "$SRC/libqcomtee/include/"*.h "$OUT/include/"

echo ">> done: $OUT/libqcomtee.a"