n_signer/build_static.sh

#!/bin/bash

# Build fully static MUSL binaries for nsigner using Alpine Docker

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUILD_DIR="$SCRIPT_DIR/build"
DOCKERFILE="$SCRIPT_DIR/Dockerfile.alpine-musl"

DEBUG_BUILD=false
TARGET_ARCH=""

while [[ $# -gt 0 ]]; do
    case "$1" in
        --debug)
            DEBUG_BUILD=true
            shift
            ;;
        --arch)
            if [[ -z "$2" ]]; then
                echo "ERROR: --arch requires a value"
                echo "Usage: $0 [--debug] [--arch <arm64|armv7|x86_64>]"
                exit 1
            fi
            case "$2" in
                arm64|armv7|x86_64)
                    TARGET_ARCH="$2"
                    ;;
                *)
                    echo "ERROR: Unsupported architecture '$2'"
                    echo "Supported values: arm64, armv7, x86_64"
                    exit 1
                    ;;
            esac
            shift 2
            ;;
        *)
            echo "ERROR: Unknown argument '$1'"
            echo "Usage: $0 [--debug] [--arch <arm64|armv7|x86_64>]"
            exit 1
            ;;
    esac
done

if [ "$DEBUG_BUILD" = true ]; then
    echo "=========================================="
    echo "nsigner MUSL Static Binary Builder (DEBUG MODE)"
    echo "=========================================="
else
    echo "=========================================="
    echo "nsigner MUSL Static Binary Builder (PRODUCTION MODE)"
    echo "=========================================="
fi
echo "Project directory: $SCRIPT_DIR"
echo "Build directory: $BUILD_DIR"
echo "Debug build: $DEBUG_BUILD"
if [[ -n "$TARGET_ARCH" ]]; then
    echo "Requested target architecture: $TARGET_ARCH"
fi
echo ""

mkdir -p "$BUILD_DIR"

if ! command -v docker &> /dev/null; then
    echo "ERROR: Docker is not installed or not in PATH"
    exit 1
fi

if ! docker info &> /dev/null; then
    echo "ERROR: Docker daemon is not running or user not in docker group"
    exit 1
fi

DOCKER_CMD="docker"

echo "✓ Docker is available and running"
echo ""

ARCH=$(uname -m)
case "$ARCH" in
    x86_64)
        HOST_ARCH="x86_64"
        ;;
    aarch64|arm64)
        HOST_ARCH="arm64"
        ;;
    armv7l|armv7)
        HOST_ARCH="armv7"
        ;;
    *)
        HOST_ARCH="unknown"
        ;;
esac

if [[ -n "$TARGET_ARCH" ]]; then
    ARCH="$TARGET_ARCH"
fi

case "$ARCH" in
    x86_64)
        PLATFORM="linux/amd64"
        OUTPUT_NAME="nsigner_static_x86_64"
        ;;
    aarch64|arm64)
        ARCH="arm64"
        PLATFORM="linux/arm64"
        OUTPUT_NAME="nsigner_static_arm64"
        ;;
    armv7l|armv7)
        ARCH="armv7"
        PLATFORM="linux/arm/v7"
        OUTPUT_NAME="nsigner_static_armv7"
        ;;
    *)
        echo "WARNING: Unknown architecture: $ARCH"
        echo "Defaulting to linux/amd64"
        PLATFORM="linux/amd64"
        OUTPUT_NAME="nsigner_static_${ARCH}"
        ;;
esac

if [[ "$HOST_ARCH" != "unknown" && "$ARCH" != "$HOST_ARCH" ]]; then
    echo "NOTE: Cross-building from host '$HOST_ARCH' to target '$ARCH'."
    if ! docker buildx version >/dev/null 2>&1; then
        echo "ERROR: docker buildx is required for cross-architecture builds but is not available."
        exit 1
    fi
    echo "✓ docker buildx is available for cross-architecture build"
    echo ""
fi

if [ "$DEBUG_BUILD" = true ]; then
    OUTPUT_NAME="${OUTPUT_NAME}_debug"
fi

echo "Building for platform: $PLATFORM"
echo "Output binary: $OUTPUT_NAME"
echo ""

echo "=========================================="
echo "Step 1: Building Alpine Docker image"
echo "=========================================="

$DOCKER_CMD build \
    --platform "$PLATFORM" \
    --build-arg DEBUG_BUILD=$DEBUG_BUILD \
    -f "$DOCKERFILE" \
    -t nsigner-musl-builder:latest \
    --progress=plain \
    .

echo ""
echo "✓ Docker image built successfully"
echo ""

echo "=========================================="
echo "Step 2: Extracting static binary"
echo "=========================================="

$DOCKER_CMD build \
    --platform "$PLATFORM" \
    --build-arg DEBUG_BUILD=$DEBUG_BUILD \
    --target builder \
    -f "$DOCKERFILE" \
    -t nsigner-static-builder-stage:latest \
    . > /dev/null 2>&1

CONTAINER_ID=$($DOCKER_CMD create nsigner-static-builder-stage:latest)
$DOCKER_CMD cp "$CONTAINER_ID:/build/nsigner_static" "$BUILD_DIR/$OUTPUT_NAME"
$DOCKER_CMD rm "$CONTAINER_ID" > /dev/null

chmod +x "$BUILD_DIR/$OUTPUT_NAME"

echo "✓ Binary extracted to: $BUILD_DIR/$OUTPUT_NAME"
echo ""

echo "=========================================="
echo "Step 3: Verifying static binary"
echo "=========================================="
echo ""

if LDD_OUTPUT=$(timeout 5 ldd "$BUILD_DIR/$OUTPUT_NAME" 2>&1); then
    if echo "$LDD_OUTPUT" | grep -q "not a dynamic executable"; then
        echo "✓ Binary is fully static"
        TRULY_STATIC=true
    elif echo "$LDD_OUTPUT" | grep -q "statically linked"; then
        echo "✓ Binary is statically linked"
        TRULY_STATIC=true
    else
        echo "⚠ WARNING: Binary may have dynamic dependencies:"
        echo "$LDD_OUTPUT"
        TRULY_STATIC=false
    fi
else
    if file "$BUILD_DIR/$OUTPUT_NAME" | grep -q "statically linked"; then
        echo "✓ Binary is statically linked (verified with file command)"
        TRULY_STATIC=true
    else
        echo "⚠ Could not verify static linking (ldd check failed)"
        TRULY_STATIC=false
    fi
fi

echo ""
echo "File size: $(ls -lh "$BUILD_DIR/$OUTPUT_NAME" | awk '{print $5}')"
echo ""

echo "Testing binary execution:"
if "$BUILD_DIR/$OUTPUT_NAME" --version 2>&1 | head -5; then
    echo "✓ Binary executes successfully"
else
    echo "⚠ Binary execution test failed"
fi

echo ""
echo "=========================================="
echo "Build Summary"
echo "=========================================="
echo "Binary: $BUILD_DIR/$OUTPUT_NAME"
echo "Size: $(du -h "$BUILD_DIR/$OUTPUT_NAME" | cut -f1)"
echo "Platform: $PLATFORM"
if [ "$DEBUG_BUILD" = true ]; then
    echo "Build Type: DEBUG"
else
    echo "Build Type: PRODUCTION"
fi
if [ "$TRULY_STATIC" = true ]; then
    echo "Linkage: Fully static binary"
else
    echo "Linkage: Static binary (verification inconclusive)"
fi

echo ""
echo "✓ Build complete!"