# OrionOS ARM64 ISO builder
# Stage 1 (alpine): downloads the official Arch Linux ARM rootfs via bsdtar.
# Stage 2 (scratch): installs packages and compiles OrionOS natively in ALARM.

# ── Stage 1: fetch and verify ALARM rootfs ────────────────────────────
FROM --platform=linux/arm64 alpine:3.20 AS alarm-fetch
# libarchive-tools provides bsdtar, which preserves ALARM's merged-usr symlinks
# (BusyBox tar mishandles /bin → usr/bin symlinks in ALARM)
RUN apk add --no-cache curl libarchive-tools

RUN curl -fL --retry 3 --progress-bar \
        http://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz \
        -o /tmp/alarm.tar.gz && \
    mkdir /alarm-root && \
    bsdtar -xpf /tmp/alarm.tar.gz -C /alarm-root && \
    rm /tmp/alarm.tar.gz && \
    test -f /alarm-root/usr/bin/bash || \
        (echo "ERROR: ALARM extraction failed — /usr/bin/bash missing" && exit 1)

# ── Stage 2: Arch Linux ARM build environment ─────────────────────────
FROM --platform=linux/arm64 scratch
COPY --from=alarm-fetch /alarm-root/ /

# ALARM uses merged-usr (/bin → usr/bin symlink). Docker's default /bin/sh
# lookup fails when the symlink isn't resolved yet — use the absolute path.
SHELL ["/usr/bin/bash", "-c"]

# Ensure a working mirrorlist (the tarball ships with a stale/empty one)
RUN echo 'Server = http://mirror.archlinuxarm.org/$arch/$repo' > /etc/pacman.d/mirrorlist

# Add DisableSandbox inside [options] (not at file end where it lands in [aur])
RUN sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf

RUN pacman-key --init && pacman-key --populate archlinuxarm

# archiso is not packaged for aarch64 in ALARM — install from upstream source.
# All other build deps are available in the standard ALARM repos.
RUN pacman -Syu --noconfirm && \
    pacman -S --noconfirm \
        base-devel \
        libx11 \
        libxft \
        fontconfig \
        freetype2 \
        imlib2 \
        imagemagick \
        fakeroot \
        git \
        sudo \
        mtools \
        dosfstools \
        libisoburn \
        squashfs-tools \
        arch-install-scripts \
        e2fsprogs \
    && pacman -Scc --noconfirm

# Install archiso from upstream source (not packaged for aarch64 in ALARM).
# Manually copy what mkarchiso needs — skip 'make install' (requires rst2man).
# Also preserve the mkinitcpio hooks from initcpio/ so the entrypoint can
# install them into the ISO airootfs (the chroot has no archiso package, so
# the hooks must come from the airootfs overlay for mkinitcpio to use them).
RUN git clone --depth=1 https://gitlab.archlinux.org/archlinux/archiso.git /tmp/archiso && \
    install -Dm755 /tmp/archiso/archiso/mkarchiso        /usr/bin/mkarchiso && \
    install -Dm755 /tmp/archiso/scripts/run_archiso.sh   /usr/bin/run_archiso && \
    install -d /usr/share/archiso && \
    cp -a /tmp/archiso/configs /usr/share/archiso/ && \
    install -Dm644 /tmp/archiso/initcpio/hooks/archiso   /usr/share/archiso/initcpio/hooks/archiso && \
    install -Dm644 /tmp/archiso/initcpio/install/archiso /usr/share/archiso/initcpio/install/archiso && \
    rm -rf /tmp/archiso

# Pre-download linux-aarch64 and create a local pacman repo so mkarchiso
# can install the kernel without depending on the [alarm] mirror at build time.
RUN pacman -Sw --noconfirm linux-aarch64 && \
    mkdir -p /alarm-local-repo && \
    find /var/cache/pacman/pkg -name "linux-aarch64-*.pkg.tar.*" ! -name "*.sig" \
        -exec cp {} /alarm-local-repo/ \; && \
    repo-add /alarm-local-repo/alarm-local.db.tar.gz /alarm-local-repo/linux-aarch64-*.pkg.tar.*

WORKDIR /orionos
COPY . .

RUN make

RUN bash themes/wallpapers/generate-default.sh || true

ENTRYPOINT ["/orionos/iso/docker/entrypoint-arm64.sh"]