#!/bin/bash
set -eux -o pipefail

# Use the Fedora 39 key for the detached signatures
KEYTOSIGNWITH='fedora-39'

VR='2.18.0-1.fc39'
RPMKEY='18b8e74c' # Fedora 39 key

do_sign() {
    # Sign with sigul unless FAKESIGN=1
    if [ ${FAKESIGN:-0} != 1 ]; then
        sigul sign-data -a $KEYTOSIGNWITH "$1" -o "$1.asc"
    else
        echo INVALID > "$1.asc"
    fi
}

# Grab the binaries out of the redistributable rpm
rpm="ignition-validate-redistributable-${VR}.noarch.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -qip $rpm | grep -P "^Signature.*${RPMKEY}$" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv './usr/share/ignition/ignition-validate-*'

# Rename the binaries
mv usr/share/ignition/ignition-validate-aarch64-apple-darwin \
    ignition-validate-aarch64-apple-darwin
mv usr/share/ignition/ignition-validate-aarch64-unknown-linux-gnu-static \
    ignition-validate-aarch64-linux
mv usr/share/ignition/ignition-validate-ppc64le-unknown-linux-gnu-static \
    ignition-validate-ppc64le-linux
mv usr/share/ignition/ignition-validate-s390x-unknown-linux-gnu-static \
    ignition-validate-s390x-linux
mv usr/share/ignition/ignition-validate-x86_64-apple-darwin \
    ignition-validate-x86_64-apple-darwin
mv usr/share/ignition/ignition-validate-x86_64-pc-windows-gnu.exe \
    ignition-validate-x86_64-pc-windows-gnu.exe
mv usr/share/ignition/ignition-validate-x86_64-unknown-linux-gnu-static \
    ignition-validate-x86_64-linux

# Sign them
do_sign ignition-validate-aarch64-apple-darwin
do_sign ignition-validate-aarch64-linux
do_sign ignition-validate-ppc64le-linux
do_sign ignition-validate-s390x-linux
do_sign ignition-validate-x86_64-apple-darwin
do_sign ignition-validate-x86_64-pc-windows-gnu.exe
do_sign ignition-validate-x86_64-linux

# Fix permissions and clean up
chmod go+r *.asc
rm $rpm; rmdir ./usr/share/ignition; rmdir ./usr/share; rmdir ./usr