# CI package recipe for a prebuilt Souveraine aarch64 binary.
#
# The runner cross-compiles first, then makepkg assembles this package.  This
# deliberately avoids compiling on the phone and keeps its agent data outside
# pacman's ownership.
pkgname=souveraine
pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
pkgrel=1
pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
url="https://gitea.wiuf.net/Fimeg/souveraine"
license=('MIT')
depends=('gcc-libs' 'alsa-lib')
options=('!strip')
source=('souveraine-binary' 'souveraine.service'
        'souveraine-secrets-binary' 'souveraine-secrets.service'
        'souveraine-machined-binary' 'souveraine-machined.service'
        'souveraine-verify-trail'
        'LICENSE')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
# sessiond ships on aarch64 only (the phone is its target; the laptop hit
# lock-screen errors with it). CI drops the two files into the build dir for
# that arch and omits them otherwise, so package() picks them up conditionally
# rather than declaring them as sources for every arch.
if [ "$CARCH" = aarch64 ]; then
    source+=('souveraine-sessiond-binary' 'souveraine-sessiond.service'
             'souveraine-sensord-binary' 'souveraine-sensord.service')
    sha256sums+=('SKIP' 'SKIP' 'SKIP' 'SKIP')
fi

package() {
    install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
    sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
        | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
    # Session authority daemon, aarch64 only. Was hand-copied to
    # /usr/local/bin and owned by no package, so it never received updates.
    # The unit points at /usr/bin: the stale /usr/local/bin copy must be
    # removed after installing or the old binary keeps running.
    if [ -f "$srcdir/souveraine-sessiond-binary" ]; then
        install -Dm755 "$srcdir/souveraine-sessiond-binary" \
            "$pkgdir/usr/bin/souveraine-sessiond"
        install -Dm644 "$srcdir/souveraine-sessiond.service" \
            "$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
    fi
    # Sensor reporter, aarch64 only — the laptop has no iio-sensor-proxy
    # sources worth reporting and no device state machine listening.
    if [ -f "$srcdir/souveraine-sensord-binary" ]; then
        install -Dm755 "$srcdir/souveraine-sensord-binary" \
            "$pkgdir/usr/bin/souveraine-sensord"
        install -Dm644 "$srcdir/souveraine-sensord.service" \
            "$pkgdir/usr/lib/systemd/user/souveraine-sensord.service"
    fi
    # Secrets rail (user service, owns org.freedesktop.secrets) and machined
    # (system service, machine identity). Both were hand-copied to the phone
    # and owned by no package — same gap as sessiond.
    install -Dm755 "$srcdir/souveraine-secrets-binary" "$pkgdir/usr/bin/souveraine-secrets"
    install -Dm644 "$srcdir/souveraine-secrets.service" \
        "$pkgdir/usr/lib/systemd/user/souveraine-secrets.service"
    # NOT shipping /usr/share/dbus-1/services/org.freedesktop.secrets.service:
    # gnome-keyring owns that path, and two packages claiming the secrets
    # provider is the collision the session-authority doctrine warns about.
    # souveraine-secrets.service already owns the bus name at runtime, so the
    # rail works without stealing the D-Bus activation file.

    install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
    install -Dm644 "$srcdir/souveraine-machined.service" \
        "$pkgdir/usr/lib/systemd/system/souveraine-machined.service"

    # Verifies the forensic trail's hash chain. Ships with the daemon that
    # writes it, not in the rootfs overlay: the overlay only reaches a device
    # at provision time, and the phone is not reflashed. Evidence nobody can
    # check is not evidence (DEVICE-STATE-MACHINE.md §11).
    install -Dm755 "$srcdir/souveraine-verify-trail" \
        "$pkgdir/usr/bin/souveraine-verify-trail"
    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
}
