#!/bin/zsh
# Builds libpff (libyal, LGPL-3.0-or-later) as a universal (arm64 + x86_64) dylib for the Mailcellar gate.
# Pinned release, checked against its SHA-256 and Joachim Metz's signature. Output only under Caches (exFAT drive).
#   build-libpff.sh            -> ~/Library/Caches/ClaudeApps/Mailcellar-gate/install/{lib/libpff.1.dylib,include}
# Needs: Xcode clang, curl, gpg (Homebrew). No autotools: the release tarball ships a generated configure.
set -euo pipefail
VERSION=20260926
SHA256=81a8cf42e69509938bb75ca74471094d3cbd17506f3d84d0e2c1253035960c23   # GitHub release asset digest, Oct 14 2026
SIGNER=0ED9020DA90D3F6E70BD3945D9625E5D7AD0177E                            # Joachim Metz <joachim.metz@gmail.com>
C=~/Library/Caches/ClaudeApps/Mailcellar-gate
TARBALL=libpff-alpha-$VERSION.tar.gz
URL=https://github.com/libyal/libpff/releases/download/$VERSION/$TARBALL
mkdir -p $C/dl $C/src $C/tools
cd $C/dl
[ -f $TARBALL ] || curl -sSL -O $URL
[ -f $TARBALL.asc ] || curl -sSL -O $URL.asc
echo "$SHA256  $TARBALL" | shasum -a 256 -c -
# Signature: isolated keyring in Caches, so Kevin's own gpg keyring is untouched.
export GNUPGHOME=$C/gnupg; mkdir -p -m 700 $GNUPGHOME
gpg --list-keys $SIGNER >/dev/null 2>&1 || {
  curl -s --max-time 30 "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x$SIGNER" -o key.asc && gpg --import key.asc; }
gpg --verify $TARBALL.asc $TARBALL 2>&1 | grep -q "Good signature" || { echo "signature check failed"; exit 1; }

rm -rf $C/src/libpff-$VERSION; tar -xzf $TARBALL -C $C/src
# configure insists on pkg-config; this stub finds no packages, so libpff uses its own bundled libyal copies.
cat > $C/tools/pkg-config <<'EOF'
#!/bin/sh
[ "$1" = "--version" ] && { echo 0.29.2; exit 0; }
case "$*" in *--atleast-pkgconfig-version*) exit 0;; esac
exit 1
EOF
chmod +x $C/tools/pkg-config
ARCHS="-arch arm64 -arch x86_64 -mmacosx-version-min=14.0"
cd $C/src/libpff-$VERSION
PKG_CONFIG=$C/tools/pkg-config CC=clang CFLAGS="$ARCHS -O2" LDFLAGS="$ARCHS -Wl,-headerpad_max_install_names" \
  ./configure --prefix=$C/install --disable-dependency-tracking --disable-static --enable-shared \
  --disable-nls --without-libintl-prefix --without-libiconv-prefix --disable-python --disable-java > $C/configure.log
make -j8 > $C/make.log 2>&1
rm -rf $C/install; make install > $C/install.log 2>&1
# Ship form: loaded from the app's Frameworks folder via @rpath (users can swap in their own build; LGPL-3 section 4d1).
install_name_tool -id @rpath/libpff.1.dylib $C/install/lib/libpff.1.dylib
lipo -info $C/install/lib/libpff.1.dylib
otool -L $C/install/lib/libpff.1.dylib | tail -n +2
cp $C/src/libpff-$VERSION/COPYING $C/src/libpff-$VERSION/COPYING.LESSER $C/install/
echo "libpff $VERSION built: $C/install"