#! /bin/bash

set -euo pipefail

if shell {grep -r KJ_DBG src/* | egrep -v '/(debug(-test)?|exception)[.]'} {
  echo '*** Error:  There are instances of KJ_DBG in the code.' >&2
  exit 1
}

if egrep -r 'TODO\(now\)' src/* {
  echo '*** Error:  There are release-blocking TODOs in the code.' >&2
  exit 1
}

make clean

if test "x$(git status --porcelain)" != "x" {
  echo "Please commit changes to git before releasing." >&2
  exit 1
}

# TODO(soon): Once we have a way to start a beta branch, refuse to do so if there are TODO(soon)s.
# if (egrep -r 'TODO\(soon\)'); then
#   echo '*** Error:  There are release-blocking TODOs in the code.' >&2
#   exit 1
# fi

source branch.conf

if test $(git rev-parse --abbrev-ref HEAD) = master {
  setvar CHANNEL = 'dev'
} elif test $IS_STABLE = true {
  setvar CHANNEL = 'stable'
} else {
  setvar CHANNEL = 'beta'
}

echo "**** Determining next build number for $CHANNEL channel ****"

setvar LAST_BUILD = $(curl -fs https://install.sandstorm.io/$CHANNEL)

if (( LAST_BUILD / 1000 > BRANCH_NUMBER )) {
  echo "ERROR: $CHANNEL has already moved past this branch!" >&2
  echo "  I refuse to replace it with an older branch." >&2
  exit 1
}

setvar BASE_BUILD = $(( BRANCH_NUMBER * 1000 ))
setvar BUILD = $(( BASE_BUILD > LAST_BUILD ? BASE_BUILD : LAST_BUILD + 1 ))
setvar BUILD_MINOR = """$(( $BUILD % 1000 ))"
setvar DISPLAY_VERSION = ""${BRANCH_NUMBER}.${BUILD_MINOR}""
setvar TAG_NAME = ""v${DISPLAY_VERSION}""
setvar SIGNING_KEY_ID = '160D2D577518B58D94C9800B63F227499DA8CCBD'

# Verify that the changelog has been updated.
setvar EXPECTED_CHANGELOG = ""### $TAG_NAME ($(date '+%Y-%m-%d'))""
if [[ "$(head -n 1 CHANGELOG.md)" != "$EXPECTED_CHANGELOG"* ]] {
  echo "Changelog not updated. First line should be:" >&2
  echo $EXPECTED_CHANGELOG >&2
  exit 1
}

# The tarball stores the version number as an integer, e.g. 75 for
# build 75 within branch 0, or 2121 for build 121 within branch 2, so
# that the Sandstorm auto-updater can avoid having complicated
# version-comparison logic.
setvar TARBALL = "sandstorm-$BUILD.tar.xz"

echo "**** Building build $BUILD ****"

make BUILD=$BUILD

echo "**** Tagging this commit ****"

# The git tag stores the version number as a normal-looking version
# number, like 0.75 for build 75 within branch 0, or 2.121 for build
# 121 within branch 2.

setvar GIT_REVISION = "$(<bundle/git-revision)"
git tag -u $SIGNING_KEY_ID $TAG_NAME $GIT_REVISION -m "Release Sandstorm ${DISPLAY_VERSION}"
git push origin $TAG_NAME

echo "**** Pushing build $BUILD ****"

rm -f $TARBALL.sig $TARBALL.update-sig install.sh.sig

# Sign the tarball and the install script. Note that we don't sign the channel build number because
# it wouldn't accomplish anything: If an attacker wanted to provide an old number, they could
# provide the old signature to match. If an attacker provided a number that hasn't been used
# before, they would not be able to provide a matching package because no such signed package
# exists.
gpg -u $SIGNING_KEY_ID --digest-algo SHA512 --detach-sig $TARBALL
gpg -u $SIGNING_KEY_ID --digest-algo SHA512 --detach-sig install.sh

# Create signature used to verify updates.
tmp/sandstorm/update-tool sign ~/.sandstorm-update-keyring $TARBALL > $TARBALL.update-sig

echo $BUILD > tmp/$CHANNEL
gce-ss copy-files $TARBALL fe:/var/www/dl.sandstorm.io
gce-ss copy-files $TARBALL.sig fe:/var/www/dl.sandstorm.io
gce-ss copy-files $TARBALL.update-sig fe:/var/www/dl.sandstorm.io
gce-ss copy-files tmp/$CHANNEL fe:/var/www/install.sandstorm.io
gce-ss copy-files install.sh fe:/var/www/install.sandstorm.io
gce-ss copy-files install.sh.sig fe:/var/www/install.sandstorm.io

gce-ss ssh alpha --command 'sudo service sandstorm update dev'