#!/usr/bin/env bash
# Install licel/jcardsim master (which has AES-GCM support) into the persistent
# aliro-smartcard-m2 Docker volume, shadowing the jcardsim-3.0.5-SNAPSHOT jar
# baked into vivokey/smartcard-ci:latest.
#
# Why: the DT smartcard-ci image pins a jcardsim fork that is 13 commits behind
# licel upstream and lacks the AES-GCM/CCM implementation merged in licel PR
# #187 (2022-07). Aliro §8.3.1.6 requires AES-256-GCM; without the impl,
# `Cipher.getInstance(AEADCipher.ALG_AES_GCM, false)` throws CryptoException.
#
# Rerun this when the base image or the m2 volume is recreated.
#
# Usage: ./scripts/install-jcardsim-gcm.sh
set -euo pipefail

IMAGE="vivokey/smartcard-ci:latest"
VOLUME="aliro-smartcard-m2"
UPSTREAM_COMMIT="aa60a02f"  # licel/jcardsim master HEAD as of 2024-04-03 (last verified)

project_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." &> /dev/null && pwd)"
build_dir="$project_root/build-tools/jcardsim"

if [[ ! -d "$build_dir" ]]; then
    echo "Cloning licel/jcardsim master into $build_dir" >&2
    mkdir -p "$project_root/build-tools"
    git clone --depth 50 https://github.com/licel/jcardsim.git "$build_dir"
fi

(cd "$build_dir" \
    && git fetch --depth 50 origin master \
    && git checkout master \
    && git reset --hard origin/master)

patches_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/jcardsim-patches"
if [[ -d "$patches_dir" ]]; then
    echo "Applying local patches from $patches_dir" >&2
    for patch in "$patches_dir"/*.patch; do
        [[ -e "$patch" ]] || continue
        (cd "$build_dir" && git apply "$patch")
    done
fi

if ! docker volume inspect "$VOLUME" >/dev/null 2>&1; then
    echo "Volume $VOLUME missing. Run ./scripts/dt-mvn.sh once first to seed it." >&2
    exit 1
fi

echo "Building jcardsim inside $IMAGE..." >&2
docker run --rm -v "$build_dir:/src" -w /src \
    -v "$VOLUME:/root/.m2" \
    --entrypoint bash \
    "$IMAGE" -c \
    "export JC_CLASSIC_HOME=/app/sdks/jc305u3_kit && \
     mvn -q -DskipTests initialize && \
     mvn -q -DskipTests package && \
     mvn -q install:install-file \
       -Dfile=target/jcardsim-3.0.5-SNAPSHOT.jar \
       -DgroupId=com.licel -DartifactId=jcardsim \
       -Dversion=3.0.5-SNAPSHOT -Dpackaging=jar \
       -DpomFile=pom.xml"

echo "Verifying AEAD implementation is present in installed jar..." >&2
docker run --rm -v "$VOLUME:/root/.m2" --entrypoint bash "$IMAGE" -c \
    "jar tf /root/.m2/repository/com/licel/jcardsim/3.0.5-SNAPSHOT/jcardsim-3.0.5-SNAPSHOT.jar \
     | grep -q 'AuthenticatedSymmetricCipherImpl.class'"

echo "jcardsim with AES-GCM installed. Run ./scripts/dt-mvn.sh test to verify." >&2