#!/usr/bin/env bash
source "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"
[[ $# == 0 || ( $# == 1 && $1 == --rebuild ) ]] || die 'Usage: tools/build-kernel [--rebuild]'
cd "$FDS_ROOT"
use_xbps
check_void_pin
tools/prepare-void
mkdir -p out/logs out/packages out/manifests
package=fds-kernel-6.12.87_1.aarch64.xbps
inputs=$(mktemp "$FDS_ROOT/out/kernel-inputs.XXXXXX")
trap 'rm -f "$inputs"' EXIT
sha256sum VOID_PACKAGES_COMMIT config/xbps-src.conf tools/build-kernel \
    image/kernel/dasung.config packages/fds-kernel/template packages/fds-kernel/files/fds.config >"$inputs"
if [[ $# == 0 && -s out/kernel/build-inputs.sha256 && -s out/kernel/payload.sha256 ]] && \
    cmp -s "$inputs" out/kernel/build-inputs.sha256 && \
    sha256sum -c out/kernel/artifacts.sha256 >/dev/null 2>&1 && \
    (cd out/kernel && sha256sum -c payload.sha256 >/dev/null 2>&1); then
    XBPS_ARCH=aarch64 xbps-rindex -fa "out/packages/$package"
    printf 'PASS: reusing verified Pi kernel build with unchanged recorded inputs\n'
    exit 0
fi
(
    cd "$FDS_VOID"
    if [[ ${1:-} == --rebuild ]]; then
        xbps_src -f -a aarch64 pkg fds-kernel
    else
        xbps_src -a aarch64 pkg fds-kernel
    fi
) 2>&1 | tee out/logs/xbps-fds-kernel.log
cp "$FDS_VOID/hostdir/binpkgs/$package" out/packages/
XBPS_ARCH=aarch64 xbps-rindex -fa "out/packages/$package"
work=$(mktemp -d "$FDS_ROOT/out/kernel-build.XXXXXX")
tar -xf "out/packages/$package" -C "$work"
[[ -s $work/boot/kernel_2712.img && -s $work/boot/bcm2712-rpi-5-b.dtb ]] || die 'Missing Pi 5 kernel/DTB'
# Reject stale packages missing any boot-critical or display-protection setting.
while IFS= read -r setting; do
    case "$setting" in
        CONFIG_*=*)
            grep -Fqx "$setting" "$work/boot/config-fds" || die "Kernel requirement missing: $setting (rebuild with tools/build-kernel --rebuild)"
            ;;
        '# CONFIG_'*' is not set')
            # Kconfig may omit disabled symbols whose dependencies are absent.
            symbol=${setting#\# }
            symbol=${symbol% is not set}
            ! grep -Eq "^${symbol}=[ym]$" "$work/boot/config-fds" || die "Kernel requirement violated: $setting (rebuild with tools/build-kernel --rebuild)"
            ;;
    esac
done < <(cat packages/fds-kernel/files/fds.config image/kernel/dasung.config)
sha256sum "out/packages/$package" "$work/boot/kernel_2712.img" "$work/boot/bcm2712-rpi-5-b.dtb" >"$work/artifacts.sha256"
cp "$work/artifacts.sha256" out/manifests/kernel-artifacts.sha256
cp "$inputs" "$work/build-inputs.sha256"
(cd "$work" && find boot usr -type f -print0 | sort -z | xargs -0 sha256sum >payload.sha256)
ln -sfn "${work##*/}" out/kernel
printf 'PASS: pinned Pi 5 kernel, modules, DTBs and boot configuration built\n'
printf 'SKIP: physical Pi boot and display behavior require hardware\n'