# Alpine Linux -- the base the apk-managed root is built on: https://alpinelinux.org/
#
# Alpine is musl with a different init, which is what SchOS is, and its
# binaries run here unmodified -- Alpine's own dynamic linker, busybox, and
# apk with TLS. So rather than port each program by hand, the root becomes an
# Alpine root that apk manages, with SchOS's own programs as an apk package of
# their own (schos-base, built by tools/posix/mkaroot.sh).
#
# Two downloads, both pinned:
#   the minirootfs  musl, busybox, apk-tools, alpine-keys, ca-certificates:
#                   the smallest root apk can work in
#   apk.static      apk itself, static, for the build host: it makes the
#                   schos-base package and its index, and installs it into
#                   the root, without anything from Alpine on the host
#
# Nothing goes into sysroot/: this is input to the root image, not part of the
# ramdisk-root system.

include ../mk/port.mk

ALPINE_BRANCH  := 3.24
ALPINE_VERSION := 3.24.3
ALPINE_MIRROR  := https://dl-cdn.alpinelinux.org/alpine/v$(ALPINE_BRANCH)

MINI     := alpine-minirootfs-$(ALPINE_VERSION)-x86_64.tar.gz
MINI_URL := $(ALPINE_MIRROR)/releases/x86_64/$(MINI)
MINI_SHA256 := f8e1cafba9b1b283b5d30d06f9885c8d2bc161ffe9083ade8e2e157813a53407

APKS     := apk-tools-static-3.0.8-r0.apk
APKS_URL := $(ALPINE_MIRROR)/main/x86_64/$(APKS)
# Recorded on first download. Alpine signs the package itself, but nothing on
# the build host could check that signature before apk.static exists.
APKS_SHA256 := c8e2c88c13ba12a12269b79a3543e1190ff8c0ab0beb32b58cadfd5881c619e3

APK_STATIC := $(PORTDIR)/apk.static

$(DISTDIR)/$(MINI): | $(DISTDIR)
	curl -fsSL -o $@ $(MINI_URL)
	sh $(SHA256CHECK) "$(MINI_SHA256)" "$@"

$(DISTDIR)/$(APKS): | $(DISTDIR)
	curl -fsSL -o $@ $(APKS_URL)
	sh $(SHA256CHECK) "$(APKS_SHA256)" "$@"

download: $(DISTDIR)/$(MINI) $(DISTDIR)/$(APKS)

# An .apk is gzipped tar streams back to back; tar reads through them and
# warns about the signature's odd headers, which is harmless.
$(APK_STATIC): $(DISTDIR)/$(APKS)
	mkdir -p $(PORTDIR)/x
	tar -xzf $< -C $(PORTDIR)/x 2>/dev/null || test -f $(PORTDIR)/x/sbin/apk.static
	cp $(PORTDIR)/x/sbin/apk.static $@
	rm -rf $(PORTDIR)/x

build install: $(APK_STATIC) $(DISTDIR)/$(MINI) world

clean:
	rm -rf $(PORTDIR)

# world.lock's packages, into dist/alpine/. Only what is missing is fetched,
# and each file is checked against the lock: a build never asks Alpine what
# is newer. `make alpine-lock` at the top level is what does that.
WORLD_DIST := $(DISTDIR)/alpine

world: | $(DISTDIR)
	mkdir -p $(WORLD_DIST)
	grep -v '^#' world.lock | while read -r f sum repo; do \
	    if [ ! -f $(WORLD_DIST)/$$f ]; then \
	        echo "alpine: fetching $$f"; \
	        curl -fsSL -o $(WORLD_DIST)/$$f.part $(ALPINE_MIRROR)/$$repo/x86_64/$$f && \
	        mv $(WORLD_DIST)/$$f.part $(WORLD_DIST)/$$f || exit 1; \
	    fi; \
	    sh $(SHA256CHECK) "$$sum" $(WORLD_DIST)/$$f >/dev/null || exit 1; \
	done

lock: $(APK_STATIC) $(DISTDIR)/$(MINI)
	sh $(TOPDIR)/tools/posix/alpine-lock.sh $(APK_STATIC) $(DISTDIR)/$(MINI) \
	    world world.lock $(WORLD_DIST)

.PHONY: world lock