#!/usr/bin/env bash
# Generate a PKCS12 release signing keystore for the Android APK (run ONCE),
# using openssl (no JDK/keytool required). Then print the base64 + values to
# paste into Forgejo repo secrets.
#
# Keep the keystore file safe and constant forever — losing it or changing it
# breaks Obtainium updates (a differently-signed APK won't install over the old
# one). PKCS12 uses ONE password for both the store and the key.
set -euo pipefail

KEYSTORE="${1:-campscan-release.keystore}"
ALIAS="${2:-campscan}"

if [ -f "$KEYSTORE" ]; then
  echo "Refusing to overwrite existing $KEYSTORE" >&2
  exit 1
fi
command -v openssl >/dev/null || { echo "openssl not found" >&2; exit 1; }

read -r -s -p "Choose a keystore password: " STOREPASS; echo
read -r -s -p "Confirm keystore password:  " STOREPASS2; echo
[ "$STOREPASS" = "$STOREPASS2" ] || { echo "Passwords do not match" >&2; exit 1; }
[ ${#STOREPASS} -ge 6 ] || { echo "Use at least 6 characters" >&2; exit 1; }

TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

# Self-signed cert + key, valid ~27 years, then bundle into a PKCS12 keystore.
openssl req -x509 -newkey rsa:2048 -sha256 -days 10000 -nodes \
  -keyout "$TMP/key.pem" -out "$TMP/cert.pem" \
  -subj "/CN=Beartaria Campgrounds/OU=Gate/O=Beartaria/C=US" 2>/dev/null

openssl pkcs12 -export \
  -inkey "$TMP/key.pem" -in "$TMP/cert.pem" \
  -name "$ALIAS" \
  -out "$KEYSTORE" \
  -passout pass:"$STOREPASS"

echo
echo "==================== Forgejo repo secrets ===================="
echo "Set these under: git.mowden.top -> CampgroundTickets -> Settings -> Actions -> Secrets"
echo
echo "ANDROID_KEY_ALIAS          = $ALIAS"
echo "ANDROID_KEYSTORE_PASSWORD  = (the password you just entered)"
echo "ANDROID_KEY_PASSWORD       = (the SAME password — PKCS12 uses one)"
echo "ANDROID_KEYSTORE_B64       = (paste the block below, single line)"
echo
base64 -w0 "$KEYSTORE"; echo
echo "============================================================="
echo "Store $KEYSTORE somewhere safe and OFF this repo (it is git-ignored)."