#!/bin/bash
# Apply the patched gnome-keyring package to a live host (ratio, later velox).
#
# Runs only after the VM gates passed and only when Craig says go. Every step
# is reversible: the encrypted keyring files are backed up with their modes,
# the stock package stays in the pacman cache for a one-command rollback, and
# only the keyring service is restarted (one unlock prompt is expected, to be
# answered in the normal system dialog, never in chat).
#
#   deploy-ratio.sh build     build the package from the repo recipe (as the user)
#   deploy-ratio.sh install   back up, install, restart the daemon, verify
#   deploy-ratio.sh rollback  reinstall the cached stock 1:51.1-1 and restart
#   deploy-ratio.sh verify    show versions, owner, restart counter, recent crashes
set -euo pipefail

repo="${ARCHSETUP_DIR:-$HOME/code/archsetup}"
recipe="$repo/packages/gnome-keyring"
build_dir="${BUILD_DIR:-$HOME/.cache/archsetup-build/gnome-keyring}"
stock_pkg="/var/cache/pacman/pkg/gnome-keyring-1:51.1-1-x86_64.pkg.tar.zst"
backup_root="$HOME/.local/share/keyrings-backup"

verify() {
    echo "host: $(uname -n)"
    pacman -Q gnome-keyring glib2
    systemctl --user show gnome-keyring-daemon.service -p ActiveState -p NRestarts -p MainPID -p ExecMainStartTimestamp
    busctl --user status org.freedesktop.secrets 2>/dev/null | grep -E '^(PID|Comm)=' || echo "no Secret Service owner"
    echo "aborts in the last hour: $(journalctl --user -u gnome-keyring-daemon.service --since '1 hour ago' --no-pager 2>/dev/null | grep -c 'Scheduled restart job')"
    sha256sum /usr/bin/gnome-keyring-daemon
}

case "${1:-}" in
build)
    [ -f "$recipe/PKGBUILD" ] || { echo "recipe missing: $recipe" >&2; exit 1; }
    rm -rf "$build_dir"; mkdir -p "$build_dir"; cp -a "$recipe/." "$build_dir/"
    (cd "$build_dir" && makepkg --noconfirm -s)
    ls -la "$build_dir"/*.pkg.tar.zst
    ;;
install)
    pkg=$(ls "$build_dir"/gnome-keyring-1:51.1-1.1-x86_64.pkg.tar.zst)
    [ -f "$stock_pkg" ] || { echo "stock package not in cache for rollback: $stock_pkg" >&2; exit 1; }
    # Permission-protected backup of the encrypted keyring files, modes kept.
    stamp=$(date +%Y%m%d-%H%M%S)
    mkdir -p "$backup_root"; chmod 700 "$backup_root"
    cp -a "$HOME/.local/share/keyrings" "$backup_root/keyrings-$stamp"
    chmod -R go-rwx "$backup_root"
    echo "backup: $backup_root/keyrings-$stamp"
    sudo pacman -U --noconfirm "$pkg"
    # Only the keyring service restarts; the socket unit stays. One unlock
    # prompt is expected afterwards.
    systemctl --user restart gnome-keyring-daemon.service
    sleep 2
    verify
    ;;
rollback)
    sudo pacman -U --noconfirm "$stock_pkg"
    systemctl --user restart gnome-keyring-daemon.service
    sleep 2
    verify
    ;;
verify)
    verify
    ;;
*)
    sed -n '2,13p' "$0"; exit 2 ;;
esac