#!/usr/bin/env bash
# GrapheneOS bring-up — STAGE 1: provision, fetch, verify, sync (Pixel 10a "stallion").
# Commands verified against grapheneos.org/build on 2026-07-07.
# The source tree is huge (~136 GiB w/ history) and is NOT committed (.gitignore: resources/grapheneos/).
# Run on the dedicated build box. Stages 2-4 (adevtool, keys, build, flash) are in
# docs/runbooks/graphene-build.md. This script is deliberately step-gated — read before running.
set -euo pipefail

# ── the ONE thing to get right: the current Stable tag (re-verify it lists "Pixel 10a") ──
TAG="${1:-2026062800}"   # Stable as of 2026-07-07. Check https://grapheneos.org/releases for newer.
DEST="${2:-$HOME/grapheneos-$TAG}"

echo "==> Target: Pixel 10a (stallion), GrapheneOS tag refs/tags/$TAG"
echo "    ⚠  Confirm on grapheneos.org/releases that $TAG is current Stable AND lists 'Pixel 10a'."
echo

echo "==> Host prerequisites (Debian/Ubuntu):"
cat <<'EOF'
    sudo apt install repo yarnpkg zip rsync git python3 gnupg openssh-client curl
    # + Node.js 24 LTS on PATH (NodeSource/nvm) for adevtool
    # + 32-bit libs:  sudo dpkg --add-architecture i386 && sudo apt update \
    #                 && sudo apt install libc6:i386 lib32stdc++6 lib32gcc-s1
    # + Debian PATH:  echo 'export PATH=$PATH:/sbin:/usr/sbin:/usr/local/sbin' >> ~/.bashrc
    # Needs: x86_64, >=32 GiB RAM, ~300 GiB free disk.
EOF
command -v repo >/dev/null || { echo "!! install the 'repo' tool first (sudo apt install repo)"; exit 1; }
command -v git  >/dev/null || { echo "!! install git first"; exit 1; }

mkdir -p "$DEST" && cd "$DEST"

echo "==> repo init (signed Stable tag — NOT a device branch; there is no 17-stallion OS branch)"
repo init -u https://github.com/GrapheneOS/platform_manifest.git -b "refs/tags/$TAG"
#   bleeding-edge dev alternative (unsigned):  repo init ... -b 17

echo "==> Verify the manifest tag signature before syncing"
curl -fsS https://grapheneos.org/allowed_signers > "$HOME/.ssh/grapheneos_allowed_signers"
( cd .repo/manifests \
  && git config gpg.ssh.allowedSignersFile "$HOME/.ssh/grapheneos_allowed_signers" \
  && git verify-tag "$(git describe)" )   # expect: Good "git" signature ... contact@grapheneos.org

echo "==> repo sync (hours; safe to re-run to resume if the network drops)"
repo sync -j"$(nproc)"

cat <<EOF

==> Sync complete. NEXT (see docs/runbooks/graphene-build.md §3-§7), from $DEST:
    source build/envsetup.sh
    yarnpkg --cwd vendor/adevtool/ install
    adevtool generate-all -d stallion       # vendor blobs (phone not needed)
    # then: generate keys (§4), patch the Dialer on callrecV2 (§5),
    #       lunch stallion-cur-user && m target-files-package (§6), sign, flash+relock (§7).
EOF