#!/bin/bash
# Builds build/stemify-<version>.ipa on a Mac. Unsigned by default, for re-signing with Sideloadly/AltStore.
# With prov/Stemify.mobileprovision, prov/key.p12 and P12_PASS set, it signs with them (keeps CarPlay/Siri).
# Uses swiftc directly so it works even when xcodebuild/actool need -runFirstLaunch.
set -euo pipefail
cd "$(dirname "$0")/.."
export PATH=/opt/homebrew/bin:$PATH
OUT=build; APP=$OUT/Payload/Stemify.app
rm -rf $OUT && mkdir -p $APP
SDK=$(xcrun --sdk iphoneos --show-sdk-path)
# Version and build number come from project.yml.
VERSION=$(sed -nE 's/^ *MARKETING_VERSION: "(.*)"/\1/p' project.yml)
BUILD=$(sed -nE 's/^ *CURRENT_PROJECT_VERSION: "(.*)"/\1/p' project.yml)

xcrun -sdk iphoneos swiftc -target arm64-apple-ios17.0 -sdk "$SDK" -O -wmo -swift-version 5 \
  -module-name Stemify -parse-as-library $(find Stemify -name '*.swift') -o $APP/Stemify

# Info.plist: xcodegen's generated one with the build settings filled in.
xcodegen generate -q
sed -e 's/$(DEVELOPMENT_LANGUAGE)/en/; s/$(EXECUTABLE_NAME)/Stemify/; s/$(PRODUCT_BUNDLE_IDENTIFIER)/org.cdnutter.stemify/' \
    -e "s/\$(PRODUCT_NAME)/Stemify/; s/\$(MARKETING_VERSION)/$VERSION/; s/\$(CURRENT_PROJECT_VERSION)/$BUILD/" \
    -e 's/$(PRODUCT_MODULE_NAME)/Stemify/' Stemify/Info.plist > $APP/Info.plist
P=$APP/Info.plist
plutil -insert MinimumOSVersion -string 17.0 $P
plutil -insert CFBundleSupportedPlatforms -json '["iPhoneOS"]' $P
plutil -insert UIDeviceFamily -json '[1]' $P
plutil -insert UIRequiredDeviceCapabilities -json '["arm64"]' $P
plutil -insert DTPlatformName -string iphoneos $P
plutil -insert CFBundleIcons -json '{"CFBundlePrimaryIcon":{"CFBundleIconFiles":["AppIcon60x60"]}}' $P
plutil -lint $P
printf 'APPL????' > $APP/PkgInfo

# Loose icon files, since actool also needs -runFirstLaunch.
SRC=Stemify/Resources/Assets.xcassets/AppIcon.appiconset/icon.png
sips -z 120 120 $SRC --out $APP/AppIcon60x60@2x.png >/dev/null
sips -z 180 180 $SRC --out $APP/AppIcon60x60@3x.png >/dev/null

if [ -f prov/Stemify.mobileprovision ] && [ -f prov/key.p12 ] && [ -n "${P12_PASS:-}" ]; then
  KC=$PWD/$OUT/sign.keychain-db; KP=$(uuidgen)
  security create-keychain -p "$KP" $KC
  security set-keychain-settings -lut 3600 $KC
  security unlock-keychain -p "$KP" $KC
  security import prov/key.p12 -P "$P12_PASS" -A -t agg -f pkcs12 -k $KC >/dev/null
  # The dev cert chains to Apple's WWDR G3 intermediate, which a fresh keychain doesn't have.
  [ -f prov/wwdr.cer ] || curl -fsSL -o prov/wwdr.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
  security import prov/wwdr.cer -A -k $KC >/dev/null 2>&1 || true
  security set-key-partition-list -S apple-tool:,apple: -s -k "$KP" $KC >/dev/null
  security list-keychains -d user -s $KC $(security list-keychains -d user | tr -d '"')
  ID=$(security find-identity -v -p codesigning $KC | sed -nE 's/.*"(Apple Development:.*)"/\1/p' | head -1)
  security cms -D -i prov/Stemify.mobileprovision > $OUT/prov.plist
  /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' $OUT/prov.plist > $OUT/ent.plist
  cp prov/Stemify.mobileprovision $APP/embedded.mobileprovision
  codesign -f -s "$ID" --entitlements $OUT/ent.plist --timestamp=none $APP
  security delete-keychain $KC
  echo "signed as $ID"
fi

(cd $OUT && zip -qry stemify-$VERSION.ipa Payload)
echo "$OUT/stemify-$VERSION.ipa"