#!/bin/bash
set -eux -o pipefail
# Use the Fedora 34 key for the detached signatures
KEYTOSIGNWITH='fedora-34'

VR='2.11.0-1.fc34'
RPMKEY='45719a39' # Fedora 34 key
ARCHES='x86_64 aarch64 ppc64le s390x'

# Grab the windows/mac binaries out of the nonlinux rpm
rpm="ignition-validate-nonlinux-${VR}.noarch.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -qip $rpm | grep -P "^Signature.*${RPMKEY}$" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv ./usr/share/ignition/ignition-validate-x86_64-apple-darwin ./usr/share/ignition/ignition-validate-x86_64-pc-windows-gnu.exe
mv ./usr/share/ignition/ignition-validate-* .
sigul sign-data -a $KEYTOSIGNWITH ./ignition-validate-x86_64-apple-darwin -o ./ignition-validate-x86_64-apple-darwin.asc
sigul sign-data -a $KEYTOSIGNWITH ./ignition-validate-x86_64-pc-windows-gnu.exe -o ./ignition-validate-x86_64-pc-windows-gnu.exe.asc 
rm $rpm; rm -r ./usr

# Grab the linux binary for a few arches we care about
for arch in $ARCHES; do
    mkdir $arch; pushd $arch
    rpm="ignition-validate-${VR}.${arch}.rpm"
    outfile="ignition-validate-${arch}-linux"
    koji download-build --key $RPMKEY --rpm $rpm
    rpm -qip $rpm | grep $RPMKEY # Verify the output has the key in it
    rpm2cpio "${rpm}" | cpio -idv ./usr/bin/ignition-validate
    mv ./usr/bin/ignition-validate "../${outfile}"
    # Add detached signature step here using $KEYTOSIGNWITH
    rm "${rpm}"; rmdir ./usr/bin; rmdir ./usr
    popd; rmdir $arch
    sigul sign-data -a $KEYTOSIGNWITH "./${outfile}" -o "./${outfile}.asc"
done

# Fix permissions
chmod go+r *.asc