n_os_tr/build.sh

#!/bin/bash
# build.sh — build the n-OS-tr live ISO
set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WORKSPACE_ISO_DIR="$REPO_ROOT/iso"
WORKSPACE_ISO="$WORKSPACE_ISO_DIR/live-image-amd64.hybrid.iso"
BUILD_LOG="$WORKSPACE_ISO_DIR/build.log"
ARTIFACTS_DIR="$WORKSPACE_ISO_DIR/config/includes.chroot_before_packages/live-artifacts"
CRELAY_SOURCE="$REPO_ROOT/includes/c_relay_static_x86_64"
NOSTR_ID_TUI_SOURCE_DIR="$REPO_ROOT/stack/nostr-id-tui"
NOSTR_ID_TUI_BINARY="$NOSTR_ID_TUI_SOURCE_DIR/build/nostr-id-tui_static_x86_64"

CLEAN_REQUESTED=0
if [[ "${1:-}" == "--clean" ]]; then
    CLEAN_REQUESTED=1
    shift
fi

if [[ "$#" -ne 0 ]]; then
    echo "[build.sh] unsupported arguments: $*" >&2
    echo "[build.sh] usage: ./build.sh [--clean]" >&2
    exit 2
fi

home_opts="$(findmnt -n -o OPTIONS /home 2>/dev/null || true)"
if [[ "$home_opts" == *nodev* ]]; then
    NEED_BIND=1
else
    NEED_BIND=0
fi

cleanup_artifacts() {
    echo "[build.sh] cleaning prior build artifacts in $WORKSPACE_ISO_DIR"
    sudo rm -rf \
        "$WORKSPACE_ISO_DIR/.build" \
        "$WORKSPACE_ISO_DIR/cache" \
        "$WORKSPACE_ISO_DIR/chroot" \
        "$WORKSPACE_ISO_DIR/binary"

    sudo rm -f \
        "$WORKSPACE_ISO_DIR"/live-image-* \
        "$WORKSPACE_ISO_DIR"/chroot.* \
        "$WORKSPACE_ISO_DIR"/binary.modified_timestamps \
        "$WORKSPACE_ISO_DIR"/build.log
}

stage_slice_bc_artifacts() {
    echo "[build.sh] staging Slice B/C artifacts in $ARTIFACTS_DIR"
    mkdir -p "$ARTIFACTS_DIR"

    if [[ ! -f "$CRELAY_SOURCE" ]]; then
        echo "[build.sh] ERROR: missing c-relay binary at $CRELAY_SOURCE" >&2
        exit 1
    fi
    cp "$CRELAY_SOURCE" "$ARTIFACTS_DIR/c_relay_x86"
    chmod 0755 "$ARTIFACTS_DIR/c_relay_x86"
    echo "[build.sh] staged c-relay binary"

    if ! command -v cargo-deb >/dev/null 2>&1; then
        echo "[build.sh] ERROR: cargo-deb not installed. Run: cargo install cargo-deb" >&2
        exit 1
    fi

    echo "[build.sh] building fips .deb"
    (
        cd "$REPO_ROOT/includes/fips"
        ./packaging/debian/build-deb.sh
    )

    FIPS_DEB="$(ls -1t "$REPO_ROOT"/includes/fips/deploy/fips_*_amd64.deb 2>/dev/null | head -1 || true)"
    if [[ -z "$FIPS_DEB" || ! -f "$FIPS_DEB" ]]; then
        echo "[build.sh] ERROR: no fips_*_amd64.deb produced in includes/fips/deploy" >&2
        exit 1
    fi

    rm -f "$ARTIFACTS_DIR"/fips_*_amd64.deb
    cp "$FIPS_DEB" "$ARTIFACTS_DIR/"
    echo "[build.sh] staged $(basename "$FIPS_DEB")"
    echo "[build.sh] building nostr-id-tui static musl binary"
    (
        cd "$NOSTR_ID_TUI_SOURCE_DIR"
        ./build_static.sh
    )

    if [[ ! -f "$NOSTR_ID_TUI_BINARY" ]]; then
        echo "[build.sh] ERROR: nostr-id-tui static build produced no binary at $NOSTR_ID_TUI_BINARY" >&2
        exit 1
    fi

    cp "$NOSTR_ID_TUI_BINARY" "$ARTIFACTS_DIR/nostr-id-tui_x86_64"
    chmod 0755 "$ARTIFACTS_DIR/nostr-id-tui_x86_64"
    echo "[build.sh] staged nostr-id-tui static binary"
}

if [[ "$CLEAN_REQUESTED" -eq 1 ]]; then
    cleanup_artifacts
fi

SCRATCH=""
BUILD_DIR=""
CLEANUP() {
    if [[ -n "$SCRATCH" ]]; then
        if mountpoint -q "$SCRATCH"; then
            sudo umount -R "$SCRATCH" 2>/dev/null || sudo umount -l "$SCRATCH" || true
        fi
        rmdir "$SCRATCH" 2>/dev/null || true
    fi
}
trap CLEANUP EXIT

if [[ "$NEED_BIND" -eq 1 ]]; then
    echo "[build.sh] /home has nodev mount option; building via bind-mounted scratch workspace"
    SCRATCH="/var/tmp/n-os-tr-build-$$-$(date +%s)"
    mkdir -p "$SCRATCH"
    sudo mount --bind "$REPO_ROOT" "$SCRATCH"
    echo "[build.sh] remounting scratch bind with dev to allow chroot /dev/null usage"
    sudo mount -o remount,bind,dev "$SCRATCH"

    scratch_opts="$(findmnt -n -o OPTIONS "$SCRATCH" 2>/dev/null || true)"
    if [[ "$scratch_opts" == *nodev* ]]; then
        echo "[build.sh] ERROR: scratch bind still has nodev after remount: $scratch_opts" >&2
        echo "[build.sh] cannot safely run live-build chroot on a nodev mount" >&2
        exit 1
    fi

    BUILD_DIR="$SCRATCH/iso"
else
    echo "[build.sh] /home is not nodev; building directly in workspace"
    BUILD_DIR="$WORKSPACE_ISO_DIR"
fi

if [[ ! -d "$BUILD_DIR" ]]; then
    echo "[build.sh] build directory missing: $BUILD_DIR" >&2
    exit 1
fi

stage_slice_bc_artifacts

cd "$BUILD_DIR"
sudo "$REPO_ROOT/lb-wrapper.sh" config
sudo "$REPO_ROOT/lb-wrapper.sh" build 2>&1 | tee "$BUILD_LOG"

if [[ ! -f "$WORKSPACE_ISO" ]]; then
    echo "[build.sh] build produced no ISO at $WORKSPACE_ISO; see $BUILD_LOG" >&2
    exit 1
fi

ls -lh "$WORKSPACE_ISO"