#!/bin/bash

set -euxo pipefail

installarch=$(uname -m)
kver=$(basename "$(ls -d /usr/lib/modules/*/)")

if [[ $installarch != "aarch64" ]]; then
    printf 'Error: this specific config is only meant for Surface Pro 12", and it is built on ARM64 chip (you have "%s" as build arch).' "$installarch"
    exit 1
fi

#======================================
# Functions...
#--------------------------------------
test -f /.kconfig && . /.kconfig
test -f /.profile && . /.profile

#======================================
# Greeting...
#--------------------------------------
echo "Configure image: [$kiwi_iname]-[$kiwi_profiles]..."

#======================================
# Set SELinux booleans
#--------------------------------------
if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]] && [[ "$kiwi_profiles" != *"WSL"* ]]; then
	## Fixes KDE Plasma, see rhbz#2058657
	setsebool -P selinuxuser_execmod 1
fi

#======================================
# Clear machine specific configuration
#--------------------------------------
## Clear machine-id on pre generated images
rm -f /etc/machine-id
echo 'uninitialized' > /etc/machine-id
## remove random seed, the newly installed instance should make its own
rm -f /var/lib/systemd/random-seed

#======================================
# Configure grub correctly
#--------------------------------------
if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]] && [[ "$kiwi_profiles" != *"WSL"* ]]; then
	## Works around issues with grub-bls
	## See: https://github.com/OSInside/kiwi/issues/2198
	echo "GRUB_DEFAULT=saved" >> /etc/default/grub
	## Disable submenus to match Fedora
	echo "GRUB_DISABLE_SUBMENU=true" >> /etc/default/grub
	## Disable recovery entries to match Fedora
	echo "GRUB_DISABLE_RECOVERY=true" >> /etc/default/grub
	## Surface Pro 12" (Snapdragon X1P-42-100): grub's gfxterm/GOP video probing
	## crashes on this GPU. Force plain text console, skip framebuffer handoff.
	echo "GRUB_TERMINAL_OUTPUT=console" >> /etc/default/grub
	echo "GRUB_GFXPAYLOAD_LINUX=text" >> /etc/default/grub
	## Surface Pro 12": GRUB_DEVICETREE is the only mechanism Fedora honours for
	## putting a devicetree line in a BLS entry -- 20-grub.install's mkbls emits
	## "devicetree /dtb-$kver/$GRUB_DEVICETREE". /etc/kernel/devicetree does
	## nothing here: /boot/<machine-id> does not exist, so kernel-install runs
	## with layout=other and 90-loaderentry.install (which would read it) bails.
	echo "GRUB_DEVICETREE=qcom/x1p42100-microsoft-sp12in.dtb" >> /etc/default/grub
	## Upstream sets menu_auto_hide=1 + boot_indeterminate=1 here for Disk images
	## to match anaconda's behaviour. Deliberately not done for Surface Pro 12":
	## with the menu hidden, GRUB counts down GRUB_TIMEOUT against a blank screen
	## and then crashes during the hand-off on this firmware, so the first boot
	## always fails and only the second succeeds. The equivalent for the
	## anaconda-installed system is the /etc/anaconda/conf.d drop-in below.
fi

#======================================
# Resize root partition on first boot
#--------------------------------------

if [[ "$kiwi_profiles" == *"Disk"* ]]; then
	mkdir -p /etc/repart.d/
	cat > /etc/repart.d/50-root.conf << EOF
[Partition]
Type=root
EOF
fi

#======================================
# Delete & lock the root user password
#--------------------------------------
if [[ "$kiwi_profiles" == *"Cloud"* ]] || [[ "$kiwi_profiles" == *"Disk"* ]] || [[ "$kiwi_profiles" == *"Live"* ]] || [[ "$kiwi_profiles" == *"WSL"* ]]; then
	passwd -d root
	passwd -l root
fi

#======================================
# Setup default services
#--------------------------------------

if [[ "$kiwi_profiles" == *"Live"* ]]; then
	## Configure livesys session
	if [[ "$kiwi_profiles" == *"GNOME"* ]]; then
		echo 'livesys_session="gnome"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"KDE"* ]]; then
		echo 'livesys_session="kde"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"Budgie"* ]]; then
		echo 'livesys_session="budgie"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"Cinnamon"* ]]; then
		echo 'livesys_session="cinnamon"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"COSMIC"* ]]; then
		echo 'livesys_session="cosmic"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"i3"* ]]; then
		echo 'livesys_session="i3"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"LXDE"* ]]; then
		echo 'livesys_session="lxde"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"LXQt"* ]]; then
		echo 'livesys_session="lxqt"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"MATE_Compiz"* ]]; then
		echo 'livesys_session="mate"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"MiracleWM"* ]]; then
		echo 'livesys_session="miraclewm"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"Sway"* ]]; then
		echo 'livesys_session="sway"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"SoaS"* ]]; then
		echo 'livesys_session="soas"' > /etc/sysconfig/livesys
	fi
	if [[ "$kiwi_profiles" == *"Xfce"* ]]; then
		echo 'livesys_session="xfce"' > /etc/sysconfig/livesys
	fi
fi

#======================================
# Setup firstboot initial setup
#--------------------------------------

if [[ "$kiwi_profiles" == *"Disk"* ]]; then
	if [[ "$kiwi_profiles" != *"GNOME"* ]] && [[ "$kiwi_profiles" != *"KDE"* ]] && [[ "$kiwi_profiles" != *"COSMIC"* ]]; then
		## Enable initial-setup
		systemctl enable initial-setup.service
		## Enable reconfig mode
		touch /etc/reconfigSys
	fi
fi

#======================================
# Setup default target
#--------------------------------------
if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]]; then
	if [[ "$kiwi_profiles" == *"Desktop"* ]]; then
		systemctl set-default graphical.target
	else
		systemctl set-default multi-user.target
	fi
fi

#======================================
# Setup default customizations
#--------------------------------------

if [[ "$kiwi_profiles" == *"Server"* ]]; then
	# Trigger lvm-devices-import.path and .service to create
	# a new /etc/lvm/devices/system.devices for the root VG.
	rm -f /etc/lvm/devices/system.devices
	touch /etc/lvm/devices/auto-import-rootvg
fi

if [[ "$kiwi_profiles" == *"Azure"* ]]; then
cat > /etc/ssh/sshd_config.d/50-client-alive-interval.conf << EOF
ClientAliveInterval 120
EOF

cat >> /etc/chrony.conf << EOF
# Azure's virtual time source:
# https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source
refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0
EOF

# Support Azure's accelerated networking feature; without this the network fails
# to come up. It may need adjustments for additional drivers in the future.
cat > /etc/NetworkManager/conf.d/99-azure-unmanaged-devices.conf << EOF
# Ignore SR-IOV interface on Azure, since it's transparently bonded
# to the synthetic interface
[keyfile]
unmanaged-devices=driver:mlx4_core;driver:mlx5_core
EOF

# Configure DHCP timeout for Azure to retry indefinitely during VM provisioning
cat > /etc/NetworkManager/conf.d/99-azure-dhcp-timeout.conf << EOF
# Azure requires VMs to attempt DHCP for at least 300 seconds during provisioning,
# as that's the upper bound of how long Azure waits to make networking available.
# NetworkManager's ipv4.dhcp-timeout setting accepts 2147483647 as a special value
# representing infinity, which ensures DHCP keeps retrying indefinitely. This is
# more robust than a fixed timeout and matches systemd-networkd's default behavior.
# Both IPv4 and IPv6 are configured to prepare for IPv6-only scenarios.
# Reference: https://networkmanager.dev/docs/api/latest/nm-settings-nmcli.html
[connection]
ipv4.dhcp-timeout=2147483647
ipv6.dhcp-timeout=2147483647
EOF
fi

if [[ "$kiwi_profiles" == *"GCE"* ]]; then
cat <<EOF > /etc/NetworkManager/conf.d/gcp-mtu.conf
# In GCP it is recommended to use 1460 as the MTU.
# Set it to 1460 for all connections.
# https://cloud.google.com/network-connectivity/docs/vpn/concepts/mtu-considerations
[connection]
ethernet.mtu = 1460
EOF
fi

if [[ "$kiwi_profiles" == *"Vagrant"* ]]; then
sed -e 's/.*UseDNS.*/UseDNS no/' -i /etc/ssh/sshd_config
mkdir -m 0700 -p ~vagrant/.ssh
cat > ~vagrant/.ssh/authorized_keys << EOKEYS
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key
EOKEYS
chmod 600 ~vagrant/.ssh/authorized_keys
chown -R vagrant:vagrant ~vagrant/.ssh/

cat > /etc/sudoers.d/vagrant << EOSUDOER
## Ensure the vagrant user always can use sudo
Defaults:vagrant !requiretty
vagrant ALL=(ALL) NOPASSWD: ALL
EOSUDOER
chmod 600 /etc/sudoers.d/vagrant

cat > /etc/ssh/sshd_config.d/10-vagrant-insecure-rsa-key.conf <<EOF
# For now the vagrant insecure key is an rsa key
# https://github.com/hashicorp/vagrant/issues/11783
PubkeyAcceptedKeyTypes=+ssh-rsa
EOF

# Further suggestion from @purpleidea (James Shubin) - extend key to root users as well
mkdir -m 0700 -p /root/.ssh
cp /home/vagrant/.ssh/authorized_keys /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
chown -R root:root /root/.ssh
fi

# https://bugzilla.redhat.com/show_bug.cgi?id=2356069
if [[ "$kiwi_profiles" == *"Container"* ]] && [[ "$kiwi_profiles" != *"Init"* ]]; then
	if [[ -f /usr/lib/tmpfiles.d/rootfiles.conf ]]; then
		systemd-tmpfiles --create /usr/lib/tmpfiles.d/rootfiles.conf
	fi
fi

if [[ "$kiwi_profiles" == *"Container"* ]] || [[ "$kiwi_profiles" == *"FEX"* ]]; then
	# Set install langs macro so that new rpms that get installed will
	# only install langs that we limit it to.
	LANG="en_US"
	echo "%_install_langs $LANG" > /etc/rpm/macros.image-language-conf

	# https://bugzilla.redhat.com/show_bug.cgi?id=1727489
	echo 'LANG="C.UTF-8"' >  /etc/locale.conf

	# https://bugzilla.redhat.com/show_bug.cgi?id=1400682
	echo "Import RPM GPG key"
	releasever=$(rpm --eval '%{?fedora}')

	# When building ELN containers, we don't have the %{fedora} macro
	if [ -z $releasever ]; then
		releasever=eln
	fi

	rpm --import /usr/share/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-primary

	echo "# fstab intentionally empty for containers" > /etc/fstab

	# Remove machine-id on pre generated images
	rm -f /etc/machine-id
	touch /etc/machine-id

	echo "# resolv placeholder" > /etc/resolv.conf
	chmod 644 /etc/resolv.conf

	# Remove extraneous files
	rm -rf /tmp/*

	# https://pagure.io/atomic-wg/issue/308
	printf "tsflags=nodocs\n" >>/etc/dnf/dnf.conf

	if [[ "$kiwi_profiles" == *"Base-Generic-Minimal"* ]]; then
		# remove some random help txt files
		rm -fv /usr/share/gnupg/help*.txt

		# Pruning random things
		rm /usr/lib/rpm/rpm.daily
		rm -rfv /usr/lib64/nss/unsupported-tools/  # unsupported

		# Statically linked crap
		rm -fv /usr/sbin/{glibc_post_upgrade.x86_64,sln}
		ln /usr/bin/ln usr/sbin/sln

		# Remove some dnf info
		rm -rfv /var/lib/dnf

		# don't need icons
		rm -rfv /usr/share/icons/*

		#some random not-that-useful binaries
		rm -fv /usr/bin/pinky

		# we lose presets by removing /usr/lib/systemd but we do not care
		rm -rfv /usr/lib/systemd
	fi
	if [[ "$kiwi_profiles" == *"Toolbox"* ]]; then
		# Remove macros.image-language-conf file
		rm -f /etc/rpm/macros.image-language-conf

		# Remove 'tsflags=nodocs' line from dnf.conf
		sed -i '/tsflags=nodocs/d' /etc/dnf/dnf.conf
	fi
fi

if [[ "$kiwi_profiles" == *"Jam"* ]]; then
# Override boot configuration in Anaconda to enable threaded IRQs
cat > /usr/share/anaconda/post-scripts/85-jam-threadirqs.ks << THREADIRQS_EOF
%post

echo "Enable threaded IRQs"
grubby --update-kernel=ALL --args="threadirqs"
%end
THREADIRQS_EOF

# Override new user configuration to add audio groups
sed -e "s/UserGroups=.*/UserGroups=wheel,jackuser,audio/" -i /etc/xdg/plasmasetuprc

# Override livesys-kde settings
cat >> /var/lib/livesys/livesys-session-extra << EOF

#setup kickoff favorites
/bin/mkdir -p /etc/skel/.config

JAMFAVORITES=/usr/share/applications/firefox.desktop,/usr/share/applications/mozilla-thunderbird.desktop,/usr/share/applications/studio-controls.desktop,/usr/share/applications/ardour6.desktop,/usr/share/applications/carla.desktop,/usr/share/applications/org.kde.konsole.desktop,/usr/share/applications/org.kde.dolphin.desktop,/usr/share/applications/systemsettings.desktop
JAMFAVORITESLIVE=/usr/share/applications/liveinst.desktop,\$JAMFAVORITES

cat <<FOE  >> /etc/skel/.config/kickoffrc
[Favorites]
FavoriteURLs=\$JAMFAVORITES
FOE

/usr/sbin/usermod -a -G jackuser,audio liveuser
EOF
fi

if [[ "$kiwi_profiles" == *"Design_suite"* ]]; then
# Add link to lists of tutorials
cat >> /usr/share/applications/list-design-tutorials.desktop << FOE
[Desktop Entry]
Name=List of design tutorials
GenericName=List of Tutorials for Designers
Comment=Reference of Design Related Tutorials
Exec=xdg-open https://fedoraproject.org/wiki/Design_Suite/Tutorials
Type=Application
Icon=applications-graphics
Categories=Graphics;Documentation;
FOE
chmod a+x /usr/share/applications/list-design-tutorials.desktop

# Add information about Fedora Design Suite
cat >> /usr/share/applications/fedora-design-suite.desktop << FOE
[Desktop Entry]
Name=Design Suite Info
GenericName=About Design Suite
Comment=Wiki page of Design Suite
Exec=xdg-open https://fedoraproject.org/wiki/Design_Suite
Type=Application
Icon=applications-internet
Categories=Documentation;
FOE
chmod a+x /usr/share/applications/fedora-design-suite.desktop

# Add information about Fedora Design Team
cat >> /usr/share/applications/fedora-design-team.desktop << FOE
[Desktop Entry]
Name=Design Team Info
GenericName=About Design Team
Comment=Documentation about Design Team
Exec=xdg-open https://docs.fedoraproject.org/en-US/design/
Type=Application
Icon=applications-internet
Categories=Documentation;
FOE
chmod a+x /usr/share/applications/fedora-design-team.desktop

# Use Powerline in bash
cat >>  /etc/profile.d/powerline-shell.sh << FOE
# Enable powerline daemon
if [ -f `which powerline-daemon` ]; then
  powerline-daemon -q
  POWERLINE_BASH_CONTINUATION=1
  POWERLINE_BASH_SELECT=1
  . /usr/share/powerline/bash/powerline.sh
fi
FOE
chmod 644 /etc/profile.d/powerline-shell.sh
# End powerline override

# Override the favorite desktop application in Dash
cat >> /usr/share/glib-2.0/schemas/org.gnome.shell.gschema.override << FOE
[org.gnome.shell]
favorite-apps=['org.mozilla.firefox.desktop', 'shotwell.desktop', 'gimp.desktop', 'darktable.desktop', 'krita.desktop', 'inkscape.desktop', 'blender.desktop', 'libreoffice-writer.desktop', 'scribus.desktop', 'kdenlive.desktop', 'nautilus.desktop', 'anaconda.desktop', 'list-design-tutorials.desktop']
FOE

# Rebuild schema cache with any overrides we installed
glib-compile-schemas /usr/share/glib-2.0/schemas
fi

if [[ "$kiwi_profiles" == *"SoaS"* ]]; then
# Get proper release naming in the control panel
cat >> /boot/olpc_build << EOF
Sugar on a Stick
EOF
cat /etc/fedora-release >> /boot/olpc_build

# Set the default Plymouth theme to the Sugar Desktop one
/usr/sbin/plymouth-set-default-theme sugar

# Fix https://bugzilla.redhat.com/show_bug.cgi?id=2239137
cat > /etc/xdg/autostart/xfce-polkit.desktop <<EOF
[Desktop Entry]
Type=Application
Name=xfce-polkit
Exec=/usr/libexec/xfce-polkit
EOF

fi

#======================================
# Surface Pro 12" customizations
#--------------------------------------

install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/yum.repos.d/kernel-sp12in.repo \
	/etc/yum.repos.d/kernel-sp12in.repo

# Device tree. kernel-surface compiles the patched dts in-tree and installs the
# result twice: into its own module tree (dtb/qcom, from dtbs_install) and into
# /usr/lib/surface-dtb/<kver>/. The latter is the master copy
# 60-surface-dtb.install re-stages into a kernel that shipped without one,
# which is the only reason the image no longer carries a prebuilt blob of its
# own -- the description installs kernel-surface by name and <ignore>s Fedora's
# kernel packages, so the package is always there.
#
# One name throughout, upstream's: this block, GRUB_DEVICETREE above, both
# kernel-install plugins, /etc/kernel/devicetree, and the ISO grub template.
#
# The module-tree and /boot copies plus the /boot/dtb symlink are what that hook
# and grubby's 10-devicetree.install would normally produce, done up front here
# because kernel-install does not run again during this build -- without the
# module-tree copy, anything keyed off /usr/lib/modules/$kver/dtb (including the
# anaconda post-script) finds nothing and silently does nothing.
dtb_name=x1p42100-microsoft-sp12in.dtb
# One directory per kernel version under /usr/lib/surface-dtb: kernel-surface is
# installonly, so nothing it owns can be version-unqualified. Only one release is
# ever installed at this point in the build, but glob anyway rather than assume.
dtb_src=$(ls -1 /usr/lib/surface-dtb/*/"$dtb_name" 2>/dev/null | sort -V | tail -n1)
if [[ -z "$dtb_src" ]]; then
	printf 'Error: no %s under /usr/lib/surface-dtb/, so kernel-surface (built from ../kernel-surface) is not installed.\n' "$dtb_name" >&2
	exit 1
fi
install -Dm644 "$dtb_src" "/usr/lib/modules/$kver/dtb/qcom/$dtb_name"
install -Dm644 "$dtb_src" "/boot/dtb-$kver/qcom/$dtb_name"
# dtbs_install ships every arm64 device tree, ~1000 boards, and the module tree
# goes straight into the image filesystem. This image targets exactly one board,
# so drop the rest -- the same objection that rules out kernel-uki-dtbloader in
# components/boot.xml. Only affects the image; a later kernel-surface update on
# the installed system restores the full tree.
find "/usr/lib/modules/$kver/dtb" -mindepth 1 \
	\! -path "/usr/lib/modules/$kver/dtb/qcom" \
	\! -name "$dtb_name" \
	-delete
# /boot/dtb -> dtb-$kver is what grubby's 10-devicetree.install maintains, and
# what the boot loader entry's devicetree path resolves through
ln -sfn "dtb-$kver" /boot/dtb
# Defer qcom_q6v5_pas past switch-root so the DSPs' auto_boot can actually find
# their firmware; see the comments in the file for the full failure mode.
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dracut.conf.d/surface-pro-12-inch.conf \
    /etc/dracut.conf.d/surface-pro-12-inch.conf
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/cmdline \
    /etc/kernel/cmdline
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree \
    /etc/kernel/devicetree
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/install.conf \
    /etc/kernel/install.conf
install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install \
	/usr/lib/kernel/install.d/60-surface-dtb.install
# Puts the "devicetree" line into the BLS entry. This is the only mechanism that
# survives an anaconda install: /etc/kernel/devicetree is never read (layout is
# always "other" on Fedora, so 90-loaderentry.install bails) and GRUB_DEVICETREE
# is dropped when anaconda rewrites /etc/default/grub from its own key list.
# kernel-install plugins do run in the target during installation, and sorting
# after 20-grub.install means the entry it generates is already there to patch.
install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install \
	/usr/lib/kernel/install.d/95-surface-dtb-patch.install
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules \
    /etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules

if [[ "$kiwi_profiles" == *"Live"* ]]; then
	# Stop anaconda hiding the GRUB menu on the installed system's first boot.
	# Only meaningful in the installer environment, hence Live-only; see the
	# comments in the file for why a hidden menu breaks this device.
	install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/anaconda/conf.d/90-surface-pro-12-inch.conf \
		/etc/anaconda/conf.d/90-surface-pro-12-inch.conf

	# Ship the CD-boot grub on the ISO, not the disk-boot one.
	#
	# kiwi picks the ISO's EFI loader by globbing the image root (see
	# Defaults.get_unsigned_grub_loader, target_type='iso'). That pattern list
	# has a CD-boot entry for x86_64 (gcdx64.efi) but none for aarch64, so here
	# it falls through to grubaa64.efi -- the *disk* image, whose baked-in grub
	# prefix is /EFI/fedora. Meanwhile kiwi writes its earlyboot config to
	# /EFI/BOOT/grub.cfg, and iso-esp-excludes.yaml deletes "fedora" from the
	# embedded ESP outright (rhbz#2358785). Net result on aarch64: the loader
	# looks for its config in a directory that was deliberately removed, fails
	# to load normal.mod, and dies before drawing anything -- black screen.
	#
	# gcdaa64.efi is byte-for-byte the same grub except its prefix is /EFI/BOOT,
	# which is exactly where kiwi puts the config. Overwrite the path kiwi globs
	# so it picks that one up instead.
	#
	# Only affects direct UEFI boot. Ventoy never executes this binary -- it
	# loopback-mounts the ISO and runs /boot/grub2/grub.cfg under its own grub.
	cp -a /boot/efi/EFI/fedora/gcdaa64.efi /boot/efi/EFI/fedora/grubaa64.efi
fi

# 51-dracut-rescue.install isn't UKI-aware -- it unconditionally sed's a BLS
# loader entry that layout=uki never creates. Mask it (kernel-install(8)'s
# documented way to disable a plugin: a /dev/null symlink of the same name).
mkdir -p /etc/kernel/install.d
ln -sf /dev/null /etc/kernel/install.d/51-dracut-rescue.install
# kernel-surface's %posttrans scriptlet already ran kernel-install once, before
# this mask existed (root overlay lands after package install), leaving a
# stale rescue image behind. Remove it now so kiwi's systemd_boot EFI-FAT-image
# step doesn't try to cram it in too.
rm -f /boot/initramfs-0-rescue-*.img /boot/loader/entries/*-0-rescue.conf

# GPU/ADSP/CDSP firmware + qcom DSP/sensor share config from the device tree repo
# (readme.md: "recursively copy the files in ./lib/ to /lib/", same for ./usr/)
cp -a /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/lib/. /lib/
cp -a /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/usr/. /usr/

build_tmp=$(mktemp -d)

# Snapshot what's installed before pulling in build-only tooling, so we can
# remove exactly what this block adds afterward -- and nothing Kiwi's own
# package lists (other team/desktop profiles) already wanted installed.
pkgs_before=$(mktemp)
rpm -qa --qf '%{NAME}\n' | sort > "$pkgs_before"

# Wi-Fi (ath12k) board file fixup, adapted from dwhinham/linux-surface-pro-11
dnf install -y python3 curl zstd
(
	cd "$build_tmp"
	cp /lib/firmware/ath12k/WCN7850/hw2.0/board-2.bin* .
	if [ -f board-2.bin.zst ]; then
		zstd -d board-2.bin.zst
	elif [ -f board-2.bin.xz ]; then
	    xz -d board-2.bin.xz
	fi
	curl --output bdencoder.py -sL \
	    https://raw.githubusercontent.com/qca/qca-swiss-army-knife/refs/heads/master/tools/scripts/ath12k/ath12k-bdencoder
	python3 bdencoder.py --extract board-2.bin
	rm -f bdencoder.py
	mv "bus=pci,vendor=17cb,device=1107,subsystem-vendor=17cb,subsystem-device=3378,qmi-chip-id=2,qmi-board-id=255.bin" \
	    /lib/firmware/ath12k/WCN7850/hw2.0/board.bin
)

# AudioReach topology; alsatplg (the topology *compiler*) is build-only, the
# compiled blob is what ships. alsa-ucm-utils' UCM profiles are read at runtime
# by the audio stack, so that one's installed separately, alongside v4l-utils below.
dnf install -y git cmake gcc gcc-c++ make pkgconf-pkg-config alsa-topology-utils m4
(
	cd /tmp/linux-msm/audioreach-topology
	git clone https://github.com/linux-msm/audioreach-topology
	cd audioreach-topology
	export FW_LOCATION=/lib/firmware
	cmake .
	make
	make install
)

# hexagonrpc + libssc + iio-sensor-proxy (fastrpc/sensor stack); not packaged in Fedora
dnf install -y \
	systemd-devel libgudev-devel polkit-devel gtk3-devel python3-devel \
	meson ninja-build gcc gcc-c++ git pkgconf-pkg-config \
	libqmi-devel glib2-devel protobuf3-c-devel gobject-introspection-devel
# meson's default prefix is /usr/local, and Fedora's dynamic linker does not
# search there -- /etc/ld.so.conf.d ships only iscsi and pipewire entries. Without
# this, libhexagonrpc.so installs fine but ld.so can't find it, and hexagonrpcd
# dies at startup with "no libhexagonrpc.so" (which then takes iio-sensor-proxy
# down with it via Requires=). Cover both libdir spellings.
printf '/usr/local/lib\n/usr/local/lib64\n' > /etc/ld.so.conf.d/surface-pro-12-inch.conf
(
	cd /tmp/harrisonvanderbyl/hexagonrpc
	meson setup build
	ninja -C build
	ninja -C build install
	ldconfig
)
(
	cd /tmp/DylanVanAssche/libssc
	meson setup _build
	meson compile -C _build
	meson install -C _build
	ldconfig
)
(
	cd /tmp/harrisonvanderbyl/iio-sensor-proxy
	meson _build -Dssc-support=enabled -Dprefix=/usr
	ninja -v -C _build install
)

# Remove exactly what got newly installed since the snapshot above (compilers,
# -devel headers, alsatplg, and whatever they pulled in transitively). Anything
# that was already installed before -- because some other team/desktop profile
# in this same build wanted it, or it's part of the base image -- is left alone.
pkgs_new=$(comm -13 "$pkgs_before" <(rpm -qa --qf '%{NAME}\n' | sort))
if [ -n "$pkgs_new" ]; then
	dnf remove -y $pkgs_new
fi
rm -f "$pkgs_before"

# UCM profiles read at runtime by the audio stack
dnf install -y alsa-ucm-utils

install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service \
	/etc/systemd/system/hexagonrpc.service

# iio-sensor-proxy keeps the unit its own build installed, and gets only the
# ordering against hexagonrpcd added on top. The drop-in is dead weight if that
# unit is not there, so check rather than let it pass silently.
test -f /usr/lib/systemd/system/iio-sensor-proxy.service
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf \
	/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf

# Only hexagonrpcd is enabled statically. iio-sensor-proxy is started through
# its D-Bus name by whatever asks for net.hadess.SensorProxy, which then pulls
# hexagonrpc.service in through the drop-in above.
systemctl enable hexagonrpc.service

# Fedora's SELinux policy has no qipcrtr_socket permissions for
# iiosensorproxy_t; the libssc backend needs them to probe the QRTR bus, and
# without them the daemon exits with "No sensors or missing kernel drivers".
# Compile and install the local module that grants them (see the .te for
# details). checkmodule/semodule_package come from checkpolicy; it stays
# installed because removing it takes policycoreutils-python-utils
# (semanage, audit2allow) with it.
dnf install -y checkpolicy
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te \
	/usr/local/share/selinux/iio-qipcrtr.te
checkmodule -M -m -o /usr/local/share/selinux/iio-qipcrtr.mod \
	/usr/local/share/selinux/iio-qipcrtr.te
semodule_package -o /usr/local/share/selinux/iio-qipcrtr.pp \
	-m /usr/local/share/selinux/iio-qipcrtr.mod
semodule -i /usr/local/share/selinux/iio-qipcrtr.pp

# Cameras (msm/camss). Nothing has to be wired up at boot. libcamera's "simple"
# pipeline handler claims qcom-camss and builds the media graph itself in
# configure(), including flipping the csiphy -> msm_csid0 link between the rear
# ov13858 and the front ov02c10, so a media-ctl unit only fights it: pinning
# csid0 to the rear sensor at boot leaves the front camera disconnected until
# something re-links it, and the formats such a unit has to guess are what made
# the old wireupcameras.service die with "Unable to setup formats: Invalid
# argument (22)" on every boot.
#
# v4l-utils stays, for inspecting the graph by hand -- media-ctl -p, and
# v4l2-ctl --stream-mmap on the RDI node to check the sensor below libcamera.
dnf install -y v4l-utils

# The front ov02c10 needs a libcamera that knows its analogue gain model and
# black level; upstream libcamera has neither, and there is no plugin mechanism
# for them, but kernel-sp12in repo offers libcamera with supported models.
# Pulled in by name because it would otherwise only arrive as a dependency,
# which makes it easy to lose without noticing.
dnf install -y libcamera libcamera-ipa

libcamera_nevra=$(rpm -q libcamera)
case "${libcamera_nevra}" in
	*.sp12in*) printf 'Using %s\n' "${libcamera_nevra}" ;;
	*)
		printf 'Error: %s is Fedora'"'"'s libcamera, not the sp12in rebuild.\n' \
			"${libcamera_nevra}" >&2
		printf 'Fedora has probably bumped the release past the rebuild; rebase\n' >&2
		printf 'patches/ in ../libcamera and tag a new release suffix.\n' >&2
		exit 1
		;;
esac

# Hardware video decode needs firmware this image is not allowed to carry. The
# qcom/vpu/vpu30_p1_s7.mbn in linux-firmware is the same codec signed with
# Qualcomm's SecTools test keys, which a retail Surface's TrustZone rejects, and
# the production-signed build exists only inside Microsoft's Surface driver
# package, under terms that grant no redistribution right.
#
# So the image ships the means rather than the blob: a script that copies it out
# of a Windows install the owner already has a licence for, and a unit that runs
# that once on a dual-boot machine. Where Windows is gone, the script says which
# driver pack to download and how to point it at one.
dnf install -y msitools
install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh \
	/usr/local/bin/surface-video-firmware.sh
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service \
	/etc/systemd/system/surface-video-firmware.service
systemctl enable surface-video-firmware.service

install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf \
	/etc/systemd/logind.conf.d/60-surface-power-key.conf

# Ambient light sensor seems to go nuts after I fixed iio-sensor-proxy. Turning
# it off for now.
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-als \
	/etc/dconf/db/local.d/00-als
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user \
	/etc/dconf/profile/user

dconf update

restorecon -Rv /usr /lib /etc/systemd /etc/dconf /etc/udev/rules.d /etc/yum.repos.d

#======================================
# Set the WSL name for ELN
#--------------------------------------
if [[ "$kiwi_profiles" == *"WSL"* ]] && [[ "$kiwi_iname" == *"ELN"* ]]; then
wsl-setup --name Fedora-ELN
fi

#======================================
# Finalization steps
#--------------------------------------
# Inhibit the ldconfig cache generation unit, see rhbz2348669
touch -r "/usr" "/etc/.updated" "/var/.updated"

if [[ "$kiwi_profiles" == *"FEX"* ]]; then
	# Remove most things except libraries used by FEX and wine stuff.
	# Most binaries that are present in non-x86 architectures should be removed,
	# so they do not run under emulation.

	# rm mingw static libs and headers
	rm -rf /usr/{x86_64,i686}-w64-mingw32/sys-root/mingw/{lib,include}

	# rm everything in libexec
	rm -rf /usr/libexec

	# rm everything in /usr/share except wine and mesa related stuff
	find /usr/share -mindepth 1 -maxdepth 1 \
		\! -name wine -a \
		\! -name mesa-demos -a \
		\! -name drirc.d -a \
		\! -name vulkan \
		\! -name licenses \
		-exec rm -rf {} \;

	# rm everything in /etc except /etc/alternatives and ld stuff
	find /etc -mindepth 1 -maxdepth 1 \
		\! -name alternatives -a \
		\! -name 'ld.so*' -a \
		\! -name '*.kiwi' \
		-exec rm -rf {} \;

	# rm non-libs in lib/lib64
	rm -rf /usr/{lib,lib64}/{locale,tmpfiles.d,systemd,modprobe.d,kbd,cmake}
	rm -rf /usr/{lib,lib64}/python*

	# lib/clc and lib64/clc are identical, replace with a symlink
	rm -rf /usr/lib/clc
	ln -s ../lib64/clc /usr/lib/clc

	# rm sbin except for ldconfig, we don't even have root in some setups
	find /usr/sbin -mindepth 1 -maxdepth 1 \
		\! -name 'ldconfig' \
		-exec rm -rf {} \;

	# rm misc stuff
	rm -rf /usr/{include,games,local,src,tmp}

	# Finally, remove most binaries except Wine stuff, Mesa stuff, the shell,
	# path-related stuff, and system info tools.
	find /usr/bin -mindepth 1 -maxdepth 1 \
		\! -name 'wine*' -a \
		\! -name 'mango*' -a \
		\! -name notepad -a \
		\! -name 'msi*' -a \
		\! -name regedit -a \
		\! -name regsvr32 -a \
		\! -name 'vulkan*' -a \
		\! -name 'vk*' -a \
		\! -name clinfo -a \
		\! -name eglinfo -a \
		\! -name glxinfo -a \
		\! -name ulimit -a \
		\! -name ldd -a \
		\! -name env -a \
		\! -name sh -a \
		\! -name bash -a \
		\! -name ls -a \
		\! -name stat -a \
		\! -name dirname -a \
		\! -name realpath -a \
		\! -name readlink -a \
		\! -name basename -a \
		\! -name nproc -a \
		\! -name uname -a \
		\! -name arch -a \
		\! -name rm \
		-exec rm -rf {} \;

	# Do this last for obvious reasons.
	rm /usr/bin/rm
fi

rm -rf /tmp/*

exit 0